Map on the dashboard

[rezuma]

I would like to edit the seach that presents the map on the dashboard.

Currently it shows the location of the IPs by security event.

I want to show the same but filtering by destination, for instance, show the location of the IPs that connected to a specific server in our organization.

is that possible?

Ramon

[southeringtonp]

It's definitely possible.

It may, however, take some work.

The ammap tool used in the Cisco app works from a static XML file that gets regenerated periodically in the background by a saved search. You would need to duplicate this functionality for each variation of the map that you want.

If you want to be able to apply filters in realtime, then you're better off converting it to use the Google Maps plugin (see link for how to do that). The Google Maps integration works differently than ammap -- each map is generated at search time for the specific result set, so you have more flexibility.

You can look at the UI Examples app or the docs to see how the XML would work. You'd probably end up wrapping the GoogleMaps module in a SearchSelectLister or similar.

[southeringtonp]

What if you just use: eventtype="cisco_firewall" | geoip src_ip

[rezuma]

I added the google maps app, very cool, but it doesnt work for me, it is not showing the results.

I do this search on the google app
eventtype="cisco_firewall" | lookup geoip clientip as src_ip | geonormalize
and it doesnt show me any results on the map 😞

Ramon