23 lines
664 B
YAML
23 lines
664 B
YAML
|
filter: "'source_ip' in evt.Meta"
|
||
|
|
name: tests/geoip-enrich
|
||
|
|
description: "Populate event with geoloc info : as, country, coords, source range."
|
||
|
|
statics:
|
||
|
|
- method: GeoIpCity
|
||
|
|
expression: evt.Meta.source_ip
|
||
|
|
- meta: IsoCode
|
||
|
|
expression: evt.Enriched.IsoCode
|
||
|
|
- meta: IsInEU
|
||
|
|
expression: evt.Enriched.IsInEU
|
||
|
|
- meta: GeoCoords
|
||
|
|
expression: evt.Enriched.GeoCoords
|
||
|
|
- method: GeoIpASN
|
||
|
|
expression: evt.Meta.source_ip
|
||
|
|
- meta: ASNNumber
|
||
|
|
expression: evt.Enriched.ASNNumber
|
||
|
|
- meta: ASNOrg
|
||
|
|
expression: evt.Enriched.ASNOrg
|
||
|
|
- method: IpToRange
|
||
|
|
expression: evt.Meta.source_ip
|
||
|
|
- meta: SourceRange
|
||
|
|
expression: evt.Enriched.SourceRange
|