Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.
UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.
Perform the following steps to download the latest version of the database and run that version in UBA:
If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.
1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases
2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:
/etc/caspida/local/conf/etl/geo-db/maxmind
3. Sync cluster:
/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/
4. Restart caspida:
/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all
To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations in the Install and Upgrade UBA manual.
