Context items can now cover groups of entities, not just individual ones. Instead of creating one item per IP address or hostname, you can create a single item that applies to an entire IP range or naming pattern.
IP ranges with CIDR notation
When creating a context item for an IP address, you can enter a CIDR range instead of a single address.
Example: your vulnerability scanners live in the 10.20.0.0/16 subnet. Create one context item for 10.20.0.0/16 with the note "Internal vulnerability scanners, port scanning from this range is expected." Any investigation involving an IP inside that range applies this context automatically.
Patterns with wildcards
For string fields such as hostnames, domains, and usernames, you can use the * character to match any sequence of characters.
Examples:
- jumpbox* matches jumpbox01, jumpbox02, and any other hostname starting with jumpbox
- *.scanner.internal matches any host under the scanner.internal domain
- svc* matches all service accounts that follow your svc naming convention
How matching works
During an investigation, Qevlar checks whether an entity falls inside a CIDR range or matches a wildcard pattern, in addition to checking exact matches.
Range and pattern items follow the same rules as all other context items:
- They are scoped to the profile they were created in. An item created in one profile does not apply to another.
- They apply to new investigations from the moment they are created.