Skip to main content

isInSubnet

A Workflow Engine function that returns true when an IP address is present within a specified subnet.

This function is available for event, alert, and enrichment workflows.

The workflow sweep up filter applies to this function.

Back to Workflow Engine Functions Reference.

Arguments

Workflow Engine function isInSubnet takes the following arguments:

Name

Required

Type

Description

field

Yes

String

Event or alert field to retrieve the IP address from.

subnet

Yes

String

Subnet to check for membership, expressed as:

  • Classless Inter-Domain Routing (CIDR): nnn.nnn.nnn.nnn/nn.

    For example: 198.51.100.0/24

  • Mask: nnn.nnn.nnn.nnn/nnn.nnn.nnn.nnn.

    For example: 198.51.100.0/255.255.255.0

Example

The following example demonstrates typical use of Workflow Engine function isInSubnet. To check if the source field for an IP address within the "198.51.100.0/24" subnet, set the following:

  • field: source_id

  • subnet: 198.51.100.0/24

The UI translates your settings to the following JSON:

{"field":"source_id","subnet":"198.51.100.0/24"}

An object with the following source_id value returns true:

source_id":"198.51.100.33"

An object with the following source_id value returns false:

source_id":"198.51.101.33"
In this section: