28 lines
932 B
YAML
28 lines
932 B
YAML
filter: "'source_ip' in evt.Meta"
|
|
name: crowdsecurity/geoip-enrich
|
|
description: "Populate event with geoloc info : as, country, coords, source range."
|
|
data:
|
|
- source_url: https://crowdsec-statics-assets.s3-eu-west-1.amazonaws.com/GeoLite2-City.mmdb
|
|
dest_file: GeoLite2-City.mmdb
|
|
- source_url: https://crowdsec-statics-assets.s3-eu-west-1.amazonaws.com/GeoLite2-ASN.mmdb
|
|
dest_file: GeoLite2-ASN.mmdb
|
|
statics:
|
|
- method: GeoIpCity
|
|
expression: evt.Meta.source_ip
|
|
- meta: IsoCode
|
|
expression: evt.Enriched.IsoCode
|
|
- meta: IsInEU
|
|
expression: evt.Enriched.IsInEU
|
|
- meta: GeoCoords
|
|
expression: evt.Enriched.GeoCoords
|
|
- method: GeoIpASN
|
|
expression: evt.Meta.source_ip
|
|
- meta: ASNNumber
|
|
expression: evt.Enriched.ASNNumber
|
|
- meta: ASNOrg
|
|
expression: evt.Enriched.ASNOrg
|
|
- method: IpToRange
|
|
expression: evt.Meta.source_ip
|
|
- meta: SourceRange
|
|
expression: evt.Enriched.SourceRange
|