committing changes in /etc made by "-bash"
Package changes:
This commit is contained in:
@@ -0,0 +1,27 @@
|
||||
filter: "'source_ip' in evt.Meta"
|
||||
name: crowdsecurity/geoip-enrich
|
||||
description: "Populate event with geoloc info : as, country, coords, source range."
|
||||
data:
|
||||
- source_url: https://crowdsec-statics-assets.s3-eu-west-1.amazonaws.com/GeoLite2-City.mmdb
|
||||
dest_file: GeoLite2-City.mmdb
|
||||
- source_url: https://crowdsec-statics-assets.s3-eu-west-1.amazonaws.com/GeoLite2-ASN.mmdb
|
||||
dest_file: GeoLite2-ASN.mmdb
|
||||
statics:
|
||||
- method: GeoIpCity
|
||||
expression: evt.Meta.source_ip
|
||||
- meta: IsoCode
|
||||
expression: evt.Enriched.IsoCode
|
||||
- meta: IsInEU
|
||||
expression: evt.Enriched.IsInEU
|
||||
- meta: GeoCoords
|
||||
expression: evt.Enriched.GeoCoords
|
||||
- method: GeoIpASN
|
||||
expression: evt.Meta.source_ip
|
||||
- meta: ASNNumber
|
||||
expression: evt.Enriched.ASNNumber
|
||||
- meta: ASNOrg
|
||||
expression: evt.Enriched.ASNOrg
|
||||
- method: IpToRange
|
||||
expression: evt.Meta.source_ip
|
||||
- meta: SourceRange
|
||||
expression: evt.Enriched.SourceRange
|
||||
Reference in New Issue
Block a user