GeoIP and ASN

GeoIP and ASN

Give SIEMLite a MaxMind-format database and every public source and destination IP gets a country, city, coordinates and autonomous system as it is stored:

./siemlite -geoip-city GeoLite2-City.mmdb -geoip-asn GeoLite2-ASN.mmdb

• Works with MaxMind GeoLite2 (free with an account; keep it fresh with geoipupdate) or GeoIP2, and the DB-IP lite databases (free, no account, CC BY 4.0). A Country database works in place of City. Either flag can be used alone.
• Files are checked hourly and reloaded when they change, so geoipupdate needs no restart.
• Private, loopback and other non-public addresses are skipped.
• Search with country=CN or asn=AS4134 (either endpoint). The country code shows next to each IP in the UI; the full location and AS name are in the event detail.

Only events stored after GeoIP is enabled are enriched.