Anyone do anything with ASN enrichment?
Daniel Jordan
Posts: 29 mod
Anyone do anything with ASN enrichment?
0
Answers
-
I see the Maxmind GeoLite2 database has it, but I don't think the GeoIP function does it?
0 -
Try to download the GeoLite2-ASN.mmdb file
0 -
It seems like it contains the correct info. See screenshot
0 -
Is the mmdb or csv preferred?
0 -
Based on the Cribl docs, I just see a reference to mmdb https://docs.cribl.io/stream/geoip-function
0 -
Correct, I have two options for ASN data with maxmind: CSV or MMDB, does Cribl have any testing on which one could be quicker?
0 -
I can only suspect the difference is minor .. in both cases the lookup will be loaded to the worker processes memory, so it should be fast regardless
0 -
Thanks!
0
