cs_hunt_ip 
Note: Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.
Use the cs_hunt_ip operator to get a list of device AIDs on which the IP was matched.
The device identifiers are returned in the AID output field. You can use this field with the cs_hunt_domain, cs_hunt_file, cs_hunt_ip, and cs_query_device operators to perform analysis and threat hunting.
Syntax
| cs_hunt_ip cs_value=<ip_address> [cs_type=<ip_type> cs_limit=<max_results>]
cs_value=<ip_address>
|
Specify an IP address enclosed in double quotes.
|
cs_type=<ip_type>
|
Optional. Specify an IP type. Possible values:
Default: |
cs_limit=<max_results>
|
Optional. Specify the maximum number of results to return. Default value: Maximum value: |
Examples
Example 1: Retrieve a list of device AIDs on which the specified IP was matched.
| cs_hunt_ip cs_value="8.222.196.43"
Example 2: Retrieve a list of device AIDs on which the specified IP of the IPv4 type was matched. Limit the returned results to 2000.
| cs_hunt_ip cs_value="10.0.0.1" cs_type="ipv4" cs_limit=2000
Example 3: Retrieve device AIDs on which the specified IP was matched and then get their device details.
| cs_hunt_ip cs_value="8.8.8.8" cs_limit=500
| cs_get_system_info cs_id_list=AID