Search for ip from file on eve.json file

Help
1

Hi,
I’m looking for a linux command, or tool, to search the eve.json file.
I have another file that only contains a list of ip addresses and I would like to know if any of these addresses appear in the eve.json file.
Do like a kind of grep but from a list of a file
Thanks

2

One of the most used tools for working on JSON files is jq see GitHub - stedolan/jq: Command-line JSON processor

3

Given an eve.json and a file containing one IP address per line, addresses.txt you can do something like the following:

cat /var/log/suricata/eve.json|jq -r 'select(.src_ip) | .src_ip' | sort -u | comm -12 - <(sort addresses.txt)

this will output the source IP addresses from eve.json that exist in addresses.txt.

4

Hi,
Great, perfect.
Thanks a lot