Skip to content

ASN enrichment

ASN enrichment adds the Autonomous System Number (as.number) to IP addresses on the event. That number identifies which autonomous system (network) the IP belongs to in public routing data.

It runs automatically for parsers that include the common-library default enrichers. You do not maintain ASN ranges in the Lookups UI; a built-in public DB-IP ASN database is applied through the asn lookup group.

ASN enricher writes only *.as.number (and related.as.number when related IPs are aggregated). Country, city, coordinates, and other location fields come from the separate geo enricher, not from ASN.

What it is for

Analysts use as.number to:

  • Identify which autonomous system an IP belongs to (for example 13238) and pivot investigations on that network.
  • Filter and group events in Discover by ASN alongside geo fields from the geo enricher.
  • Build detections that care about unexpected ASNs (ASN is about routing ownership; geo is about location).
  • Correlate scans, C2, or unusual egress when several IPs share the same ASN.

Location context (country, city, region) still comes from geo enrichment on the same event.

How it works

In the common library, the default IP ASN enricher is:

Parsers/Default/Enrichers/ip_asn.yaml

define:
  type: parsec/enricher/ip
  group: asn

schema:
  /Schemas/ECS.yaml:
    postfix: as.

  /Schemas/CEF.yaml:
    section: as

What this means:

  • group: asn loads ASN IP-range data from /lookups/asn/ (built as *.ipr files by the IP address processor).
  • With ECS, postfix: as. maps the lookup attribute number onto fields such as source.as.number, destination.as.number, or client.as.number, depending on which IP field was resolved.
  • The built-in declaration is Lookups/public-dbip-asn-num.yaml (group: asn, global). It is not listed as a normal editable lookup in the UI; it is prepared for Parsec by the platform.

Fields added by the ASN enricher:

Event field Meaning
source.as.number / destination.as.number / … ASN for that entity’s IP
related.as.number Aggregated list of ASNs from related IPs on the event

Geolocation fields such as source.geo.country_iso_code, destination.geo.city_name, or related.geo.location are filled by Parsers/Default/Enrichers/ip_geo.yaml (group: geo), not by the ASN enricher.

Only IPs that match the ASN database get as.number. Private or unmapped addresses may still receive geo data and have no ASN field.

Example event

After parsing a FortiGate traffic log, enrichment can produce fields like this (excerpt):

{
  "source.ip": "2a02:6b8:b010:9020::1:abcd",
  "destination.ip": "15.40.71.82",
  "source.as.number": 13238,
  "related.as.number": [13238],
  "source.geo.country_iso_code": "RU",
  "destination.geo.country_iso_code": "US",
  "destination.geo.city_name": "Palo Alto"
}
  • source.as.number / related.as.number: from the ASN enricher.
  • *.geo.*: from the geo enricher.

In this sample only the source IP received an ASN match; the destination may omit destination.as.number when no ASN record applies.

In Discover you can search for example:

source.as.number:13238

or:

related.as.number:13238

Using ASN in detections

Treat as.number like any other event field in predicates. Example: alert when traffic involves a specific ASN:

predicate:
  !AND
  - !IN
    what: source.as.number
    where: !EVENT
  - !EQ
    - !ITEM EVENT source.as.number
    - 13238

For allow/deny lists of many ASNs, put the numbers in a lookup and test membership with !IN / !LOOKUP (see Lookups in detections).

Tips

  • ASN enrichment depends on public routing data. Values can lag behind renumbering or change over time.
  • Use as.number for exact filters. Do not expect organization or geo attributes from the ASN enricher; use geo enrichment for location.
  • If as.number is missing on public IPs, check that default enrichers are included for the parser and that ASN lookup files are present under /lookups/asn/ (ask an administrator).
  • Custom MaxMind or UI geo zones do not replace ASN; use Geolocation lookups and Custom MaxMind enricher for location-specific data.