CIDR Notation for LEM rule

Question

Hi,

I would like create a rule in LEM that will give me an alert whenever it detects any logins failed or successful from external IP (Public IP). I plan to use the filter below (sample only for 10.0.0.0/8) but I think it would be more accurate if I can use CIDR notation but not sure if LEM currently supports it. Any inputs will be very much appreciated.

Thanks a lot!

Neil

curtisi · Accepted Answer

There isn't a way to do that in the LEM, but I definitely think it's worthy of a Feature Request .  It already looks like you have your first supporting vote in msteinvertifi !  The LEM's Feature Request forum is here: Log &amp; Event Feature Requests