Is there a way to turn on Geo IP location for the logs that have Source IP data in them? So for example I can see the Caller IP in the following log but no country code or GEO location and we want to add this. Is there way to do this without using Chronicle or anything like that?
"requestMetadata": { "callerIp": "174.95.10.102", "callerSuppliedUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36,gzip(gfe),gzip(gfe)", "requestAttributes": { "time": "2023-09-09T13:35:56.357323112Z", "auth": {} },
Best answer by Anonymous
If you can bring your logs to BigQuery, you can use IPinfo's IP to Country ASN data from Analytics Hub to run the queries against the log. The database is updated daily and is free to use.
SELECT
logs.IP, -- IP columns from the table
country_asn.* -- Result from country_asn table lookup
FROM
`analyticshub_free_country_asn.log_data` AS logs
JOIN
`analyticshub_free_country_asn.country_asn` AS country_asn
ON
NET.IP_FROM_STRING(logs.IP) BETWEEN NET.IP_FROM_STRING(country_asn.start_ip)
AND NET.IP_FROM_STRING(country_asn.end_ip);
Here is what the output will look like:
3 replies
A
Anonymous
Answer
September 14, 2023
If you can bring your logs to BigQuery, you can use IPinfo's IP to Country ASN data from Analytics Hub to run the queries against the log. The database is updated daily and is free to use.
SELECT
logs.IP, -- IP columns from the table
country_asn.* -- Result from country_asn table lookup
FROM
`analyticshub_free_country_asn.log_data` AS logs
JOIN
`analyticshub_free_country_asn.country_asn` AS country_asn
ON
NET.IP_FROM_STRING(logs.IP) BETWEEN NET.IP_FROM_STRING(country_asn.start_ip)
AND NET.IP_FROM_STRING(country_asn.end_ip);
Here is what the output will look like:
A
Anonymous
September 19, 2023
If you can bring your logs to BigQuery, you can use IPinfo's IP to Country ASN data from Analytics Hub to run the queries against the log. The database is updated daily and is free to use.
SELECT
logs.IP, -- IP columns from the table
country_asn.* -- Result from country_asn table lookup
FROM
`analyticshub_free_country_asn.log_data` AS logs
JOIN
`analyticshub_free_country_asn.country_asn` AS country_asn
ON
NET.IP_FROM_STRING(logs.IP) BETWEEN NET.IP_FROM_STRING(country_asn.start_ip)
AND NET.IP_FROM_STRING(country_asn.end_ip);
Here is what the output will look like:
Thanks.
So outside of big query there is no way to do this in something like Log Explorer? I am guessing not but figured I would ask.
Thx
A
Anonymous
September 19, 2023
Thanks.
So outside of big query there is no way to do this in something like Log Explorer? I am guessing not but figured I would ask.
Thx
Not to my knowledge. I believe Log Explorer does not have any support for log data enrichment.
