If you have Zeek compiled with
GeoLocation support,
this package will add a nested record called geo to the conn log that
contains fields for each originating and responding IP that describe:
- Country code
- Region
- City
- Latitude
- Longitude
- Autonomous System Number
- Autonomous System Organization
A GeoLite2 geolocation database is included with the package for out-of-the-box functionality.
This package includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
This package was inspired by an old Zeek script conn-add-geodata.bro which unfortunately lacks author or license information. Before creating this package, a thread on public Zeek Slack was initiated in an attempt to hunt down the author, but no definitive answer was found. This package goes further by being delivered as a Zeek package and by adding fields for more than just country info.
Per MaxMind documentation, the free GeoLite2 database is less accurate than the paid GeoIP2 version. While the author of this package has not attempted it, the docs indicate that the paid version should work as a "drop-in replacement".
The MaxMind docs also indicate the database is updated weekly, every Tuesday. All attempts will be made to keep the database version in this repo current. However, if you're concerned about accuracy, you may want to create your own MaxMind login and keep your local copy up to date.
If you delete the database files GeoLite2-City.mmdb and GeoLite2-ASN.mmdb that come with this
package, Zeek will fall back to looking for databases in default locations. See
zeek/zeek#3547 for details.