Malformed Syntax Error When Searching ipv6addr With a CIDR of 128
book
Article ID: 378305
calendar_today
Updated On:
Products
Carbon Black Hosted EDR (formerly Cb Response Cloud)
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
When doing a process search for an IPv6 address with a CIDR range of /128, a malformed syntax error is returned.
Example Search:
ipv6addr:::1/128
Environment
- Carbon Black EDR Console: 7.8.0 and Lower
Cause
IPv6 search handling did not account for single IP returned with IPv6 CIDR range.
Resolution
The /128 CIDR is a single IP, instead use just the direct IPv6 address as a workaround.
ipv6addr:::1
Additional Information
- This will be corrected in the 7.9.0 server release with CRE-19180
Feedback
thumb_up
Yes
thumb_down
No