search

cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://cisagov.github.io/Malcolm/
Other
1.96k stars 328 forks source link

standardize locations/sources for GeoIP database #394

Open mmguero opened 1 week ago

mmguero commented 1 week ago

@mmguero cloned issue idaholab/Malcolm#485 on 2024-06-06:

Arkime has its geoip database (see arkime/scripts/arkime_update_geo.sh) and logstash uses the geoip filter (see logstash/pipelines/beats/12_lookups.conf and logstash/pipelines/enrichment/11_lookups.conf), but they don't necessarily use the same database.

We should standardize:

  1. Where these databases (the mmdb files) come from, probably just pull them once outside of the containers' Dockerfiles build and then include them into the docker containers rather than pull them as part of the Dockerfile

  2. Coordinate periodic updates (this is a bit tricker, where do the files get stored?)

  3. examine other uses of GeoIP if any (I don't think we're doing it with Zeek, as we're pushing that off to logstash)