Wazuh: With Maxmind not supporting GeoIP egacy database how can we make use of GeoIP lookup in 3.10?

[zin1x]

As above

[Zenidd]

Hello @zin1x,

While Wazuh still has the ability to read GeoIP databases through the geoipdb option, we are currently using Filebeat along with the GeoIP Processor in Elasticsearch to obtain geographic location information based on IP addresses.

There is a pipeline that will match the following fields of the alert:

• data.srcip
• data.win.eventdata.ipAddress
• data.aws.sourceIPAddress

The first one is included by default in most Linux systems, the second one is related to Window systems and the third one is related to the AWS integration.

Keep in mind that geoIP requires the IP to be public in order to be able to locate it, for example, the IP: 10.2.1.2 (subnet) won't trigger geoIP but the 216.23.2.15 (public) will do.

Hope this resolves your doubt, let me know if you need further help

Regards, Juan Pablo Sáez

[branchnetconsulting]

As you described, in most cases it is adequate, and even more robust, to have GeoIP lookups performed via the Elasticsearch ingest geoip processor plugin at the behest of Filebeat.

However, for people using custom Wazuh rules that use GeoIP lookup results as part of the rule criteria, the Filebeat/Elasticsearch geoip method performs the lookups too late for Wazuh rules to use the lookup results.

The Wazuh geoipdb option is still needed for such cases. I recommend that we add GeoLite2 format support to the Wazuh geoipdb option, or perhaps just switch it over to solely support the GeoLite2 mmdb format since that is the only format supported upstream anyway.

In the mean time, here is a script that apparently can be used to convert modern Maxmind geoip files to the legacy format.

https://github.com/sherpya/geolite2legacy

Kevin Branch

[Zenidd]

I hadn't considered the GeoIP events enrichment(prior to its check against the rules) so I tried to use The Wazuh geoipdb option:

These are the steps I have followed to make it work:

• Firstly, the Wazuh manager has to be compiled with theUSE_GEOIP=yesflag:
  make TARGET=server USE_GEOIP=yes

• Here you can download the GeoLite2 free databases. You should choose the City version in CSV format, zipped. I tried the Country version with no luck.

• I can confirm that geolite2legacy works on converting from current to a legacy(supported by Wazuh) database file. You should copy the GeoLite2-City-CSV file to the geolite2legacy source directory and then convert the DB with the command above:
  ./geolite2legacy.py -i GeoLite2-City-CSV_20191008.zip -f geoname2fips.csv -o GeoIP.dat
  Then copy the converted GeoIP DB inside the Wazuh directory:
  cp GeoIP.dat /var/ossec/etc

• Output with Wazuh GeoIP DB

**Phase 2: Completed decoding.
       decoder: 'sshd'
       dstuser: 'root'
       srcip: '2.136.147.146'
       srcgeoip: 'ES / Catalonia'  <----------- Wazuh GeoIP DB field
       srcport: '1055'

**Phase 3: Completed filtering (rules).
       Rule id: '100011'
       Level: '15'
       Description: 'Log attempt from ES / Catalonia'
**Alert to be generated.

And... it works! Thanks @branchnetconsulting for the awesome advice. @zin1x, now you have these two GeoIP alternatives to choose the one that fits your use case. Greetings,

JP Sáez

[danimegar]

Hi @Zenidd
I had to do some more steps to show the GeoIP info:

Add the following lines to local_internal_options.conf:

• analysisd.geoip_jsonout=1
• maild.geoip=1

Add the following lines to ossec.conf:

<global>
    ...
    ...
    <geoipdb>/var/ossec/etc/GeoIP.dat</geoipdb>
</global>

<alerts>
    ...
    ...
    <use_geoip>yes</use_geoip>
</alerts>

Regards,
Daniel.