Cidr_match on multiple subnets

[michelledrew (drew)]

Hello, I was wondering if any of you guys knew whether i could use cidr_match multiple times in one pipeline…
e.g.
when
has_field(“src_ip”)
then
set_field(“internal_ip”, cidr_match(“subnet/mask”, to_ip($message.src_ip)));
set_field(“internal_ip”, cidr_match(“subnet/mask”, to_ip($message.src_ip)));
set_field(“internal_ip”, cidr_match(“subnet/mask”, to_ip($message.src_ip)));

I want the cidr_match to happen on all subnets. So far it just checks on the first one, to see whether they’re internal or not. Is this possible? Thank you in advance!

[fangycz]

rule “blabla”
when
cidr_match(“192.168.0.0/16”, to_ip($message.src_ip)) ||
cidr_match(“172.16.0.0/12”, to_ip($message.src_ip)) ||
cidr_match(“10.0.0.0/8”, to_ip($message.src_ip))
then
set_field(“internal_ip”, true);
end