Project

General

Profile

Actions

Feature #6999

open

output/json: enrich EVE w/ libmaxminddb geoip info

Added by Juliana Fajardini Reichow 3 months ago. Updated 2 months ago.

Status:
In Review
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Work proposed and executed by Fandi Gunawan
PR: https://github.com/OISF/suricata/pull/10703

From PR description:
Adding optional geoip enrichment into Eve-log by setting geoip-enrichment option under eve-log configuration in suricata.yaml.
The JSON structure of geoip is based on Elastic ECS geo specification.
This is to avoid the cost of additional resources in RAM, CPU, and storage for achieving a similar result with logstash.

Actions #1

Updated by Juliana Fajardini Reichow 3 months ago

  • Assignee changed from Community Ticket to Fandi Gunawan
Actions #2

Updated by Jason Ish 3 months ago

Actions #3

Updated by Jason Ish 3 months ago

Some initial thoughts.

If Suricata is going to block, or alert based on the geoip keyword I think it is important to log that context along with the alert. GeoIP databases differ or get out of date so you don't want Suricata making a decision on one GeoIP database, and enriching that log with another.

What I'm not so sure about is if all events should be enriched. This is typically where I'd recommend post-processing. Moving it to Suricata because Logstash is slow isn't a very strong reason, as Logstash is generally slow and there could be other ways... Filebeat with Elastic ingest streams is probably much faster. And I'm hesitant to add yet another toggle to the config.

Thoughts? I think the ECS schema layout is good here, but should probably take a quick look at the OCSF schema for similar data as well.

Actions #4

Updated by Fandi Gunawan 2 months ago

Jason Ish wrote in #note-3:

Some initial thoughts.

If Suricata is going to block, or alert based on the geoip keyword I think it is important to log that context along with the alert. GeoIP databases differ or get out of date so you don't want Suricata making a decision on one GeoIP database, and enriching that log with another.

What I'm not so sure about is if all events should be enriched. This is typically where I'd recommend post-processing. Moving it to Suricata because Logstash is slow isn't a very strong reason, as Logstash is generally slow and there could be other ways... Filebeat with Elastic ingest streams is probably much faster. And I'm hesitant to add yet another toggle to the config.

Thoughts? I think the ECS schema layout is good here, but should probably take a quick look at the OCSF schema for similar data as well.

Yes you are correct, the last publicly available database is from 2018, however, MaxMind provides a more recent and updated database trough different scheme.
To enrich data, data needs to be deserialize and converted to other format is costly from my perspective. I adds geoip supports is due to Suricata supports geoip using the same library used by Logstash or Filebeat.

Actions

Also available in: Atom PDF