{
  "description": "Event contains one or more entries part of the private network CIDR blocks (RFC 1918)",
  "list": [
    "10.0.0.0/8",
    "172.16.0.0/12",
    "192.168.0.0/16"
  ],
  "matching_attributes": [
    "ip-src",
    "ip-dst",
    "domain|ip",
    "ip-dst|port",
    "ip-src|port"
  ],
  "name": "List of RFC 1918 CIDR blocks",
  "type": "cidr",
  "version": 5
}