IP ranges of common services?

[chergett]

I'm curious as to how others are handling the allow-listing of common IP ranges for networks like Google, Microsoft, etc. I'm trying to think of a way to easily suppress alerts for false positives coming from "trusted" providers. Perhaps there are services out there that combine this information into an easily digestible format for using with ids rules? For example, Google lists 214 separate ranges just for the United States.

[TOoSmOotH]

I would tune thresholds vs allowing cart blanche access to "trusted" providers. Those trusted providers are used all the time as c2 head ends because they are "trusted". I have seen google drive and twitter used as command and control for many threat groups. They just access a text file shared on google drive or follow a twitter account to know what to do etc.

[Acewiza]

Microsoft was hosting Azure-based Russian election meddlers in 2020.