<reponame>williamclot/elastalert2
import ipaddress
from elastalert.enhancements import BaseEnhancement, DropMatchException
from elastalert import util

class DropIntruderIOIP(BaseEnhancement):
    # This enhancement ensures we don't alert on Intruder.IO IP's
    # which frequently scan our Infra.
    def process(self, match):
        ranges = [
            "172.16.31.10/26",
            "192.168.3.11/25",
            "192.168.3.11/25",
            "192.168.3.11/25",
            "192.168.127.12/26",
            "192.168.3.11/26",
            "172.16.17.32/25",
            "192.168.3.11/25",
            "172.16.58.3/24",
            "172.16.31.10/32"
        ]

        for range in ranges:
            try:
                if ipaddress.ip_address(match["source"]["ip"]) in ipaddress.ip_network(range):
                    raise DropMatchException()
            except Exception as e:
                util.elastalert_logger.error(e)

import ipaddress
from elastalert.enhancements import BaseEnhancement, DropMatchException
from elastalert import util

class DropIntruderIOIP(BaseEnhancement):
    # This enhancement ensures we don't alert on Intruder.IO IP's
    # which frequently scan our Infra.
    def process(self, match):
        ranges = [
            "172.16.31.10/26",
            "192.168.3.11/25",
            "192.168.3.11/25",
            "192.168.3.11/25",
            "192.168.127.12/26",
            "192.168.3.11/26",
            "172.16.17.32/25",
            "192.168.3.11/25",
            "172.16.58.3/24",
            "172.16.31.10/32"
        ]

        for range in ranges:
            try:
                if ipaddress.ip_address(match["source"]["ip"]) in ipaddress.ip_network(range):
                    raise DropMatchException()
            except Exception as e:
                util.elastalert_logger.error(e)
# This enhancement ensures we don't alert on Intruder.IO IP's # which frequently scan our Infra.