geoip-attack-map
geoip-attack-map copied to clipboard
MatthewClarkMay
Plot by dst_ip.
Hello,
First off I love this map. It's a nice KISS (Keep It Simple Stupid) approach which I've been looking for. Thank you for developing it.
I've been able to feed the map from our SIEM without an issue. One thing I've noticed is the is seems to plot from src_ip -> hqLatLng (from the static/map.js). We have multiple sites around the county and it would be useful for it to plot from src_ip -> dst_ip.
Is this possible with the current code? It seems to take the dst_ip from the feed but I don't see where it actually uses it along with the maxmind data to plot from src -> dst.
If it does not, I'll see what I can kludge together. Thank you again.
I was able to "kludge" the code to do what I wanted. It isn't clean by any stretch, but I could try and clean it up if you think it would be a helpful option to other people.
Also - Have you considered a licenses for your software?
Great to hear you found a workaround! I would love to see what you've come up with if you'd like to share your code. I don't have a ton of time to dedicate to this project so contributions are appreciated. I released it under GPL, but this is my first large open source project I've ever had so I'm learning as I go.
Just wanted to say that I would find this useful as well. We're attempting to do the same thing, if you have any hints @beave I would appreciate them.
I'm attempting to do the same thing. Could any charitable soul show us the way?
