CDB List Support for IPv6

[Robby Hunters]

Dear Wazuh Team,

I have created an IPv4 list for Indonesian IP addresses using a CDB list.

May I use a CDB list to also create and manage a list of IPv6 addresses?

Thank you.

Best regards,
Robby

[Md. Nazmur Sakib]

Hi Robby,

Yes, CDB lists can contain IPv6 addresses and can be used to check events containing these.
If you need to include the : character as part of the key, you must escape the complete key using quotation marks. For example:

"2001:0db8:85a3:0000:0000:8a2e:0370:7334":

Ref: Creating a CDB list

But make sure to use the CDB list value as it appears in the alert field. The shortened version will not work if the logs have the full version of the IP.

Let me know if you need any further information on this.