search

MatthewClarkMay / geoip-attack-map

Cyber security geoip attack map that follows syslog and parses IPs/port numbers to visualize attackers in real time.
Apache License 2.0
353 stars 203 forks source link

Plot by dst_ip. #16

Open beave opened 7 years ago

beave commented 7 years ago

Hello,

First off I love this map. It's a nice KISS (Keep It Simple Stupid) approach which I've been looking for. Thank you for developing it.

I've been able to feed the map from our SIEM without an issue. One thing I've noticed is the is seems to plot from src_ip -> hqLatLng (from the static/map.js). We have multiple sites around the county and it would be useful for it to plot from src_ip -> dst_ip.

Is this possible with the current code? It seems to take the dst_ip from the feed but I don't see where it actually uses it along with the maxmind data to plot from src -> dst.

If it does not, I'll see what I can kludge together. Thank you again.

beave commented 7 years ago

I was able to "kludge" the code to do what I wanted. It isn't clean by any stretch, but I could try and clean it up if you think it would be a helpful option to other people.

Also - Have you considered a licenses for your software?

MatthewClarkMay commented 7 years ago

Great to hear you found a workaround! I would love to see what you've come up with if you'd like to share your code. I don't have a ton of time to dedicate to this project so contributions are appreciated. I released it under GPL, but this is my first large open source project I've ever had so I'm learning as I go.

BeanBagKing commented 7 years ago

Just wanted to say that I would find this useful as well. We're attempting to do the same thing, if you have any hints @beave I would appreciate them.

suhiherazeN1N commented 5 years ago

Please share the codes @beave

FernandoHiagon commented 4 years ago

I'm attempting to do the same thing. Could any charitable soul show us the way?