Skip to content

Commit

Permalink
Wiki update for new Geolocation functionality (#957)
Browse files Browse the repository at this point in the history
  • Loading branch information
philrz authored Jul 30, 2020
1 parent 616d859 commit 54be2c7
Show file tree
Hide file tree
Showing 5 changed files with 44 additions and 0 deletions.
42 changes: 42 additions & 0 deletions docs/Geolocation.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# Geolocation

- [Summary](#summary)
- [Examples](#examples)
- [Origin](#origin)
- [Future Functionality](#future-functionality)

# Summary

Starting with `v0.14.0`, Brim now adds [geolocation](https://en.wikipedia.org/wiki/Geolocation) fields to the `conn` records
of Zeek logs that are generated from imported pcaps.

# Examples

The following screenshot shows where the geolocation fields may be found in the Log Detail view:

![Geolocation in Log Detail](media/Geolocation-Log-Detail.png)

This screenshot shows an example aggregation that uses geolocation data:

![Geolocation Aggregation](media/Geolocation-Aggregation.png)

# Origin

The data is added by the [geoip-conn](https://github.com/brimsec/geoip-conn) Zeek package. For details on the origin and accuracy
of the geolocation data, see the [README](https://github.com/brimsec/geoip-conn/blob/master/README.md).

# Future Functionality

There are additional geolocation features in Brim that may be added in the future, depending on demand from the community.
The following issues are currently being held open to gather interest:

| **Issue** |**Description** |
|--------------------------------------------------------|------------------------------------------------|
| [brim/936](https://github.com/brimsec/brim/issues/936) | Geolocation map visualization |
| [brim/954](https://github.com/brimsec/brim/issues/954) | Look up Geolocation data on-demand |
| [brim/955](https://github.com/brimsec/brim/issues/955) | Allow user to replace the Geolocation database |

If you're interested in additional geolocation features, please follow the links to review these issues and click :+1: below the
description on any of these features you'd like to see added. If you have additional feedback or ideas on this functionality,
feel free to add a comment to the issues, or join our
[public Slack](https://join.slack.com/t/brimsec/shared_invite/zt-cy34xoxg-hZiTKUT~1KdGjlaBIuUUdg) and talk to us. Thanks!
1 change: 1 addition & 0 deletions docs/Home.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ effective use of the Brim desktop application and related tools.

- [[Zeek JSON Import]]
- [[Zeek Customization]]
- [[Geolocation]]

## Developer Resources

Expand Down
1 change: 1 addition & 0 deletions docs/_Sidebar.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@

- [[Zeek JSON Import]]
- [[Zeek Customization]]
- [[Geolocation]]

**Developer Resources**

Expand Down
Binary file added docs/media/Geolocation-Aggregation.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/media/Geolocation-Log-Detail.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 54be2c7

Please sign in to comment.