elastic / elastic/roadmap

Lookup IP database information in ES|QL queries

Open
#106 1 comment 0 reactions 1 assignee Assigned to @tylerperk View on GitHub
Component: Elasticsearch product-area:observability product-area:security v9.5.0
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**What the feature is**
Dynamic Geographical Enrichment of IP Addresses at Query Time

**Value Proposition**

Instantly add geographical details (such as country, city, and coordinates) to IP addresses directly within your search queries. This command provides immediate geographical context for network activity and enables location-based analysis and visualization on demand, offering greater flexibility and reducing the need for upfront data modification compared to ingest-time processing. Specifically, users want to extract an IP address that was not parsed at ingest time and apply an ip-to-geo lookup using the internal MMDB databases. This feature would enhance their security analytics capabilities by allowing dynamic GEO data enrichment during search.

**Expected Outcome**
Flexible On-Demand Enrichment: Unlike geoip or IP_Location ingest pipeline processors that enrich data at indexing, this command allows users to dynamically add geographical information to IP addresses during a query. This means enrichment can be applied selectively when needed, without pre-processing all data.
Reduced Ingest Overhead: Data does not need to be enriched with geo-location fields at ingest if it's not always required, preserving storage space and reducing indexing time.
Enhanced Ad-hoc Analysis: Analysts can quickly add location context to any IP address in their results during an investigation, even for data that was not originally enriched at ingest, supporting dynamic threat hunting and incident response.
Always Current Geo-Data: Queries can automatically use the latest available geo-IP database, ensuring that location information is as accurate and up-to-date as possible without requiring re-indexing of historical data.
Improved Security Analysis: Gain a geographical dimension for identifying suspicious logins, unusual traffic patterns, or potential security breaches across different regions.
Location-Based Reporting and Visualization: Easily create maps, regional breakdowns, and reports that show the geographical distribution of your data, all based on freshly enriched query results.

**Optional: Key user stories / use cases**

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.