splunk
SecKit for geolocation with MaxMind
Splunk Labs
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
This supporting add-on (SA) for Splunk advanced IP information enrichment using the MaxMind family of databases.
Welcome
This supporting add-on (SA) for Splunk advanced IP information enrichment using the MaxMind family of databases.
https://www.maxmind.com/en/geoip2-databases
Supported
* City2Lite
* City2 (optional)
* ISP (optional)
* ConnectionType (optional)
Installation search head only
- Install the SecKit_SA_geolocation app
- Configure the geoipupdate input with your account details this is now required even for free usage
- Note: Account ID is the numeric account number do not use your account id or email
USAGE Note "fieldname" must be actual field
| `seckit_iplocation(fieldname)`
| `seckit_iplocation(fieldname,prefix)`
Where fieldname is the name of the field containing the IP
prefix is the prefix to assign to the output fields
Example 1
| NOOP | stats count | EVAL src="8.8.4.4" | `seckit_iplocation(src)`
Example 2
tag=network tag=communicate | `seckit_iplocation(src,"geo")`
FIELDS
- city (City/CityLite)
- country (City/CityLite)
- lat (City/CityLite)
- long (City/CityLite)
- connection_type (ConnectionType)
- isp (ISP)
- isp_organization (ISP)
- isp_ip (ISP)
- isp_asn (ISP)
- isp_asn_organization (ISP)
Source
https://github.com/splunk/seckit_sa_geolocation
Legal
- Splunk is a registered trademark of Splunk, Inc.
- MaxMind is a registered trademark of MaxMind, Inc.
Release Notes
Version 6.1.0
Aug. 11, 2021
Version 6.0.9
Feb. 13, 2021
6.0.9 (2021-02-13)
Bug Fixes
6.0.9-develop.5 (2021-02-12)
Bug Fixes
- timeout (e42986a)
6.0.9-develop.4 (2021-02-12)
Bug Fixes
- venv (bf30852)
6.0.9-develop.3 (2021-02-12)
Bug Fixes
- shebang (61b73c5)
6.0.9-develop.2 (2021-02-12)
Bug Fixes
- missing crud ini (393e5bc)
6.0.9-develop.1 (2021-02-12)
Bug Fixes
- Publish Release notes (fafe1bf)
6.0.8 (2021-02-12)
Bug Fixes
- new release config (7aab4ab)
6.0.8-develop.4 (2021-02-12)
Bug Fixes
- config (e622b5b)
6.0.8-develop.3 (2021-02-12)
Bug Fixes
- changelog (ab97d6a)