The filter selects UserLogon events with a populated RemoteAddressIP4 field and excludes the listed non-external ranges, including private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). Negating cidr() retains addresses outside those ranges, and ipLocation() adds geolocation data without changing the event type. LogScale documents that cidr() filters events by IP subnet ranges and that !cidr() permits addresses not in the specified ranges.
Community Discussion