SecKit for geolocation with MaxMind
Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
This supporting add-on (SA) for Splunk advanced IP information enrichment using the MaxMind family of databases.
Welcome
This supporting add-on (SA) for Splunk advanced IP information enrichment using the MaxMind family of databases.
https://www.maxmind.com/en/geoip2-databases
Supported
City2Lite
City2 (optional)
ISP (optional)
ConnectionType (optional)
Installation search head only
- Install the SecKit_SA_geolocation app
- Configure the geoipupdate input with your account details this is now required even for free usage
- Note: Account ID is the numeric account number do not use your account id or email
USAGE Note "fieldname" must be actual field
| `seckit_iplocation(fieldname)`
| `seckit_iplocation(fieldname,prefix)`Where fieldname is the name of the field containing the IP
prefix is the prefix to assign to the output fields
Example 1
| NOOP | stats count | EVAL src="8.8.4.4" | `seckit_iplocation(src)`Example 2
tag=network tag=communicate | `seckit_iplocation(src,"geo")`FIELDS
- city (City/CityLite)
- country (City/CityLite)
- lat (City/CityLite)
- long (City/CityLite)
- connection_type (ConnectionType)
- isp (ISP)
- isp_organization (ISP)
- isp_ip (ISP)
- isp_asn (ISP)
- isp_asn_organization (ISP)
Source
https://github.com/splunk/seckit_sa_geolocation
Legal
- Splunk is a registered trademark of Splunk, Inc.
- MaxMind is a registered trademark of MaxMind, Inc.
Release Notes
Version 5.0.7
March 12, 2020
Version 5.0.6
March 3, 2020
Minor update missing JS files due to misconfigured gitignore
Version 5.0.4
Feb. 19, 2020
- Update maxmind geoip update utility
- Require account and token now that MaxMind is suspended anonymous downloads of mmdb
- Python2/3 support
Version 4.1.0R059fc1a
Aug. 12, 2019
- Update geolocation utility to version 4.0.3
- Ensure +x is set on geolocation utility
Version 2.0.5
Sept. 1, 2016