From 4ca325bf2c7e2ad7d7bc248c2b1f677e809f8536 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 24 Oct 2024 12:49:51 +0530 Subject: [PATCH 1/5] Added new field for the ASN operator doc --- .../search-query-language/search-operators/asn-lookup.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/search/search-query-language/search-operators/asn-lookup.md b/docs/search/search-query-language/search-operators/asn-lookup.md index 77e735cdf0..a568106c92 100644 --- a/docs/search/search-query-language/search-operators/asn-lookup.md +++ b/docs/search/search-query-language/search-operators/asn-lookup.md @@ -19,12 +19,11 @@ lookup\ from asn://default on ip\ | `*` | Use a wildcard (`*`) character as a shortcut to return both fields. | | `asn` | Autonomous System Number | | `organization` | Autonomous System Organization Name (Carrier) or ID in some cases. | +| `registering_organization` | | ## Example -The following query references a data stream with IPv4 addresses, parses -those IPv4 addresses, and then uses ASN Lookup to retrieve their -autonomous system information.  +The following query references a data stream with IPv4 addresses, parses those IPv4 addresses, and then uses ASN Lookup to retrieve their autonomous system information.  ```sql _sourceCategory=stream "remote_ip=" From 4d8d69912afa75a213d701a7e8075c53ab1dbf76 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 24 Oct 2024 12:53:38 +0530 Subject: [PATCH 2/5] minor fix --- .../search/search-query-language/search-operators/asn-lookup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/search/search-query-language/search-operators/asn-lookup.md b/docs/search/search-query-language/search-operators/asn-lookup.md index a568106c92..b924d8a046 100644 --- a/docs/search/search-query-language/search-operators/asn-lookup.md +++ b/docs/search/search-query-language/search-operators/asn-lookup.md @@ -28,5 +28,5 @@ The following query references a data stream with IPv4 addresses, parses those I ```sql _sourceCategory=stream "remote_ip=" | parse regex "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" -| lookup organization, asn from asn://default on ip = ip +| lookup organization, registering_organization, asn from asn://default on ip = ip ``` From 4c03071156583a2e091280b2573c0e4caf8e35ee Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 24 Oct 2024 13:17:37 +0530 Subject: [PATCH 3/5] Update asn-lookup.md --- .../search-query-language/search-operators/asn-lookup.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/search/search-query-language/search-operators/asn-lookup.md b/docs/search/search-query-language/search-operators/asn-lookup.md index b924d8a046..12024c8cab 100644 --- a/docs/search/search-query-language/search-operators/asn-lookup.md +++ b/docs/search/search-query-language/search-operators/asn-lookup.md @@ -18,15 +18,15 @@ lookup\ from asn://default on ip\ |:--|:--| | `*` | Use a wildcard (`*`) character as a shortcut to return both fields. | | `asn` | Autonomous System Number | -| `organization` | Autonomous System Organization Name (Carrier) or ID in some cases. | -| `registering_organization` | | +| `organization` | The name of the organization that owns the ASN or ID in some cases. This organization is responsible for the routing of traffic for network blocks. | +| `registering_organization` | The organization responsible for the actions and content associated with a given block of IP addresses. Registering Organizations include many types of entities, including corporate, government, or educational entities, and ISPs managing the allocation and use of network blocks. | ## Example The following query references a data stream with IPv4 addresses, parses those IPv4 addresses, and then uses ASN Lookup to retrieve their autonomous system information.  ```sql -_sourceCategory=stream "remote_ip=" +_dataTier=all _sourceCategory=*/katta "remote_ip=" | parse regex "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | lookup organization, registering_organization, asn from asn://default on ip = ip ``` From 87fc1bbc52e9656ff763212865e789463a1e1438 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 4 Nov 2024 13:14:37 +0530 Subject: [PATCH 4/5] Update docs/search/search-query-language/search-operators/asn-lookup.md --- .../search/search-query-language/search-operators/asn-lookup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/search/search-query-language/search-operators/asn-lookup.md b/docs/search/search-query-language/search-operators/asn-lookup.md index 12024c8cab..e508742f9b 100644 --- a/docs/search/search-query-language/search-operators/asn-lookup.md +++ b/docs/search/search-query-language/search-operators/asn-lookup.md @@ -26,7 +26,7 @@ lookup\ from asn://default on ip\ The following query references a data stream with IPv4 addresses, parses those IPv4 addresses, and then uses ASN Lookup to retrieve their autonomous system information.  ```sql -_dataTier=all _sourceCategory=*/katta "remote_ip=" +_dataTier=all _sourceCategory=stream "remote_ip=" | parse regex "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | lookup organization, registering_organization, asn from asn://default on ip = ip ``` From 54d6c9703ded5cb883e8b20132f42b25e3f0edca Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Wed, 13 Nov 2024 17:52:24 +0530 Subject: [PATCH 5/5] Update docs/search/search-query-language/search-operators/asn-lookup.md --- .../search/search-query-language/search-operators/asn-lookup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/search/search-query-language/search-operators/asn-lookup.md b/docs/search/search-query-language/search-operators/asn-lookup.md index e508742f9b..4669498df4 100644 --- a/docs/search/search-query-language/search-operators/asn-lookup.md +++ b/docs/search/search-query-language/search-operators/asn-lookup.md @@ -18,7 +18,7 @@ lookup\ from asn://default on ip\ |:--|:--| | `*` | Use a wildcard (`*`) character as a shortcut to return both fields. | | `asn` | Autonomous System Number | -| `organization` | The name of the organization that owns the ASN or ID in some cases. This organization is responsible for the routing of traffic for network blocks. | +| `organization` | The name of the organization that owns the ASN or ID in some cases. This organization (Carrier) is responsible for the routing of traffic for network blocks. | | `registering_organization` | The organization responsible for the actions and content associated with a given block of IP addresses. Registering Organizations include many types of entities, including corporate, government, or educational entities, and ISPs managing the allocation and use of network blocks. | ## Example