geoip-enrich Log Parser by crowdsecurity | CrowdSec Hub

geoip-enrich

Log parser

By: crowdsecurity
Version: 0.5

Populate event with geoloc info : as, country, coords, source range.

Install with a top-level collection

7 collections include it

sudo cscli collections install crowdsecurity/magento

Installs 4 parsers and 4 scenarios.

View Magento →

Installation

sudo cscli parsers install crowdsecurity/geoip-enrich

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s02-enrich/crowdsecurity/geoip-enrich.yaml· 38 linesGitHub

1filter: |1
2  let ipv6Check = IsIPV6(evt.Meta.source_ip);
3  "source_ip" in evt.Meta &&
4  (
5    not ipv6Check &&
6    not (IpInRange(evt.Meta.source_ip, "127.0.0.0/8") || IpInRange(evt.Meta.source_ip, "192.168.0.0/16") || IpInRange(evt.Meta.source_ip, "172.16.0.0/12") || IpInRange(evt.Meta.source_ip, "10.0.0.0/8"))
7  ) ||
8  (
9    ipv6Check &&
10    not (IpInRange(evt.Meta.source_ip, "::1/128") || IpInRange(evt.Meta.source_ip, "fd00::/8") || IpInRange(evt.Meta.source_ip, "fc00::/7"))
11  )
12
13name: crowdsecurity/geoip-enrich
14description: "Populate event with geoloc info : as, country, coords, source range."
15data:
16  - source_url: https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
17    dest_file: GeoLite2-City.mmdb
18  - source_url: https://hub-data.crowdsec.net/mmdb_update/GeoLite2-ASN.mmdb
19    dest_file: GeoLite2-ASN.mmdb
20statics:2
21  - method: GeoIpCity
22    expression: evt.Meta.source_ip
23  - meta: IsoCode
24    expression: evt.Enriched.IsoCode
25  - meta: IsInEU
26    expression: evt.Enriched.IsInEU
27  - meta: GeoCoords
28    expression: evt.Enriched.GeoCoords
29  - method: GeoIpASN
30    expression: evt.Meta.source_ip
31  - meta: ASNNumber
32    expression: evt.Enriched.ASNNumber
33  - meta: ASNOrg
34    expression: evt.Enriched.ASNOrg
35  - method: IpToRange
36    expression: evt.Meta.source_ip
37  - meta: SourceRange
38    expression: evt.Enriched.SourceRange

Installed on

Know where it runs

Documentation

The GeoIP module relies on geolite database to provide enrichment on source ip.

The following informations will be added to the event :

Meta.IsoCode : two-letters country code
Meta.IsInEU : a boolean indicating if IP is in EU
Meta.GeoCoords : latitude & longitude of IP
Meta.ASNNumber : Autonomous System Number
Meta.ASNOrg : Autonomous System Name
Meta.SourceRange : The public range to which the IP belongs

This configuration includes GeoLite2 data created by MaxMind available from https://www.maxmind.com, it includes two data files: