Search attacks from one country

[Jaymaree]

Hi fellows,

Is there a way to search for attacks from one particular country? I know there are pie charts available in the Overview page, but when I click on a country it won't show me the results of the chosen country.

I hope there is sort of query out there 🙂

Thanks in advance.

[lguinn2]

If your data has an IP address that identifies the source, then you can use the iplocation command. Assuming that the field name of the IP address is "source_ip", then this command will work to show you the country.

a_search_that_identifies_potential_attacks
| iplocation source_ip
| table source_ip  Country  City  Region lat lon

By default, the command adds the additional fields to each event. Find out more in the docs at iplocation command You can filter the results by country or compute statistics with the returned fields, etc.

I am sure that the results aren't perfect, but I think that they are based on the free version of the MAXMIND database.

[ppuru]

As far as I understand, every country has a unique pattern of IP addresses allocated. hence the simplest and the easiest way is to perform a search based on source IP address (probably you can make use of regular expression here or wildcard*).
But in reality, often sophisticated attacks take place through many nodes (multiple hijacked computers across the globe), making it difficult to identify the source node or country in fact.