Skip to main content
Panther Knowledge Base

How do I add CIDR lookup tables and match them against IP addresses in Panther?


How do I add CIDR lookup tables and match them against IP addresses? Currently, we are expanding the CIDR range into the complete list of all IP addresses in the range and using that as the lookup table. However, sometimes these ranges are enormous, especially for IPv6 addresses, making them too large to enumerate.


To do this, you can create a Lookup Table containing the CIDR list. See Panther's Enrichment: Lookup Tables documentation for more information.

Here is an example schema:

  cidr: "any"

This schema allows you to use CIDR ranges in your Lookup Table dataset, as shown below:

ip_range       | location
---------------+---------------------   | SanFran Office | Berlin Office   | Hong Kong Data Centre

When an IP address, such as is received, it can be correctly enriched as location="SanFran Office".

  • Was this article helpful?