Graylog2 / Graylog2/graylog2-server

MaxMind GeoIP ISP Support

Open
#12,153 4 comments 2 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

Do you plan to add support for MaxMind GeoIP ISP databases?

## Why?

The GeoLite2-ASN database provides basic ASN information for Geoip lookups, but it doesn't provide organization-level information. It would be great to be able to add the [GeoIP2-ISP database](https://www.maxmind.com/en/geoip2-isp-database)

The database returns no data when trying to add it under ASN or any other database type in the data adapter.

When looking at the MaxMind Java documentation (https://maxmind.github.io/GeoIP2-java/), it looks like the only difference between ISP and ASN is the additional fields and the database reader variable.

### ASN
```
// A File object pointing to your GeoLite2 ASN database
File database = new File("/path/to/GeoLite2-ASN.mmdb");

// This creates the DatabaseReader object. To improve performance, reuse
// the object across lookups. The object is thread-safe.
try (DatabaseReader reader = new DatabaseReader.Builder(database).build()) {

InetAddress ipAddress = InetAddress.getByName("128.101.101.101");

AsnResponse response = reader.asn(ipAddress);

System.out.println(response.getAutonomousSystemNumber()); // 217
System.out.println(response.getAutonomousSystemOrganization()); // 'University of Minnesota'
}
```

### ISP
```
// A File object pointing to your GeoIP2 ISP database
File database = new File("/path/to/GeoIP2-ISP.mmdb");

// This creates the DatabaseReader object. To improve performance, reuse
// the object across lookups. The object is thread-safe.
DatabaseReader reader = new DatabaseReader.Builder(database).build();

InetAddress ipAddress = InetAddress.getByName("128.101.101.101");

IspResponse response = reader.isp(ipAddress);

System.out.println(response.getAutonomousSystemNumber()); // 217
System.out.println(response.getAutonomousSystemOrganization()); // 'University of Minnesota'
System.out.println(response.getIsp()); // 'University of Minnesota'
System.out.println(response.getOrganization()); // 'University of Minnesota'
```

## Your Environment

* Graylog Version: 4.2.6+0210617, codename Noir
* Elasticsearch Version: 7.10.2
* MongoDB Version: 4.2.18
* Operating System: Amazon Linux 2
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.