How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA)?
Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.
UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.
Perform the following steps to download the latest version of the database and run that version in UBA:
If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.
1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases
2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:
/etc/caspida/local/conf/etl/geo-db/maxmind
3. Sync cluster:
/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/
4. Restart caspida:
/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all
To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations in the Install and Upgrade UBA manual.
Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.
UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.
Perform the following steps to download the latest version of the database and run that version in UBA:
If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.
1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases
2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:
/etc/caspida/local/conf/etl/geo-db/maxmind
3. Sync cluster:
/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/
4. Restart caspida:
/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all
To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations in the Install and Upgrade UBA manual.