External IP location

[Meena27]

Hi,

We have set to receive alerts like Brute force, Port Scanning from external IPs.

Is there anyway or query in Splunk to get the Country information about the External IP?

[MuS]

Hi Meena27,

sure there is, you can use iplocation to get this kind of information and use geostats to show it on a google map inside Splunk.

cheers, MuS

[Meena27]

Thanks MuS.

Please let me know how to install the Geo IP app and is Google Map is necessary for that?

[jmeyers_splunk]

you don't need an app for this. these commands are built into splunk. just have a search that includes an ip address, pipe that to iplocation and then pipe that to geostats. for example:

sourcetype=access_combined | iplocation clientip | geostats count

With that and 6.1+ you will have the option for "map" visualization. You can also supply anything to iplocation which is an IP and other aggregate operations to geostats. See the references for the search commands that @MuS already included above.