topic Re: Map on the dashboard in Dashboards & Visualizations

Map on the dashboard

rezuma — Tue, 09 Nov 2010 02:07:58 GMT

I would like to edit the seach that presents the map on the dashboard.

Currently it shows the location of the IPs by security event.

I want to show the same but filtering by destination, for instance, show the location of the IPs that connected to a specific server in our organization.

is that possible?

Ramon

Re: Map on the dashboard

southeringtonp — Tue, 09 Nov 2010 04:19:21 GMT

It's definitely possible.

It may, however, take some work.

The ammap tool used in the Cisco app works from a static XML file that gets regenerated periodically in the background by a saved search. You would need to duplicate this functionality for each variation of the map that you want.

If you want to be able to apply filters in realtime, then you're better off converting it to use the Google Maps plugin (see link for how to do that). The Google Maps integration works differently than ammap -- each map is generated at search time for the specific result set, so you have more flexibility.

You can look at the UI Examples app or the docs to see how the XML would work. You'd probably end up wrapping the GoogleMaps module in a SearchSelectLister or similar.

Re: Map on the dashboard

rezuma — Mon, 28 Sep 2020 09:20:34 GMT

I added the google maps app, very cool, but it doesnt work for me, it is not showing the results.

I do this search on the google app
eventtype="cisco_firewall" | lookup geoip clientip as src_ip | geonormalize
and it doesnt show me any results on the map 😞

Ramon

Re: Map on the dashboard

southeringtonp — Mon, 28 Sep 2020 09:20:40 GMT

What if you just use: eventtype="cisco_firewall" | geoip src_ip