Skip to main content

ASN Lookup Search Operator

Sumo Logic can lookup an Autonomous System Number (ASN) and organization name by an IP address. Any IP addresses that do not have an ASN will return null values.

Syntax

The ASN Lookup operator uses lookup-classic with a specific path, asn://default, to provide the ASN and associated organization.

lookup\<field\> from asn://default on ip\<ip_address\>
Lookup fieldsDescription
*Use a wildcard (*) character as a shortcut to return both fields.
asnAutonomous System Number
organizationAutonomous System Organization Name (Carrier) or ID in some cases.

Example

The following query references a data stream with IPv4 addresses, parses those IPv4 addresses, and then uses ASN Lookup to retrieve their autonomous system information. 

_sourceCategory=stream "remote_ip="
| parse regex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| lookup organization, asn from asn://default on ip = ip
Status
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.