BRIM

Rich Data Types in Zed: Map & IP

Author Phil Rzewski

I recently came across a tweet that showed a jq command line that aggregated the output of a Masscan report into a more readable form. It certainly was an improvement over the raw report, but rich Zed data types like maps and IP addresses help you go much further with this data. In just a few short minutes the video below shows how you can

  • Browse and iteratively construct intuitive queries in Zui to pick apart the nested data,
  • Perform CIDR-based filtering (thanks to the true IP address data type!),
  • Turn the report into a map for easy key/value retrieval, and
  • Make the same map available in Python as a dictionary.