{
  "description": "Event contains one or more entries part of the RFC 1918 CIDR blocks",
  "list": [
    "10.0.0.0/8",
    "172.16.0.0/12",
    "192.168.0.0/16"
  ],
  "matching_attributes": [
    "ip-src",
    "ip-dst",
    "domain|ip"
  ],
  "name": "List of RFC 1918 CIDR blocks",
  "type": "cidr",
  "version": 3
}