matthewclarkmay / geoip-attack-map Goto Github PK
View Code? Open in Web Editor NEWCyber security geoip attack map that follows syslog and parses IPs/port numbers to visualize attackers in real time.
License: Apache License 2.0
Cyber security geoip attack map that follows syslog and parses IPs/port numbers to visualize attackers in real time.
License: Apache License 2.0
Hello, i just recently set up my geoip-attack-map, everything works fine when am using dummy traffic, i have a SIEM that has been configured to send logs to the Attackmap server but whenever i run Dataserver.py it shows NOT A VALID LOG. Is there a solution for this??
Hi,
It seems that you included your own apikey for mapbox. So it seems you have run out of api calls. I registered my own account on mapbox however my account doesn't have the map that is being used ("mmay601.p9if994e") Is there any way you can share it or explain how to create the map that is currently used?
Thank you in advanced.
Hi,
This project is really amazing. However, I'm trying to point attack source ip to destination ip on map instead of limiting to headquarters (based on info from syslog). So it would be a great help if you can point me on how to get this done..
Thanks!!
Why can't my map be displayed?
Everything else is right that the map is black.
@MatthewClarkMay
How to log normalization ?
Hello,
First off I love this map. It's a nice KISS (Keep It Simple Stupid) approach which I've been looking for. Thank you for developing it.
I've been able to feed the map from our SIEM without an issue. One thing I've noticed is the is seems to plot from src_ip -> hqLatLng (from the static/map.js). We have multiple sites around the county and it would be useful for it to plot from src_ip -> dst_ip.
Is this possible with the current code? It seems to take the dst_ip from the feed but I don't see where it actually uses it along with the maxmind data to plot from src -> dst.
If it does not, I'll see what I can kludge together. Thank you again.
There are currently several constant variable included in DataServer.py and AttackMapServer.py. Should we add these to one file and import them?
Thoughts/Ideas?
How to slow down the speed of simulate dummy traffic?The lines on the map are very messy.
One of the big issues with DataServer.py is that memory is constantly consumed. Variables are ever growing, and this needs to change, so maybe we should use a database? I'm thinking we incorporate mongodb, and track metrics there. That way variables aren't tracking metrics the entire time, and we save on memory space.
Thoughts/Ideas?
Hello,
Hope you doing well.
How can i configure geoIP-attack-map with my Arcsight ESM.
Can you please help out for this issue.
Thanking you.
Devang Raval.
I have noticed that the current code only displays inbound traffic to the headquarters (main location). However, I believe it would be beneficial to also visualize outbound traffic from the headquarters, particularly the traffic that sends data to random IP addresses, such as reverse shell traffic.
To facilitate the task of stopping and starting the process, follow the process I did:
OS: Debian
[Unit]
Description = Geoip Attack Snort LOG
After = syslog.target network.target
[Service]
Type = simple
ExecStart = / home/user/geoip-attack-map/AttackMapServer/AttackMapServer.py
[Install]
WantedBy = multi-user.target
[Unit]
Description = Geoip Attack Snort LOG DATA
After = syslog.target network.target
[Service]
Type = simple
ExecStart = /home/ user/geoip-attack-map/DataServer/DataServer.py
[Install]
WantedBy = multi-user.target
Please share some handy free normalization techniques that sweets for this map
I like seeing what percentage of the project is HTML, Python, JavaScript, Bash, etc, so I'm thinking about separating the HTML and JavaScript into separate files (index.html, and index.js).
Thoughts/Ideas?
If there are residual logs in /var/log/syslog, they will all be processed by DataServer.py when initialized. I would prefer if it only processed real time events.
Two options:
Thoughts/Ideas?
I'm interested to try it on CentOS, any help?
Hello
Can you help me with your application.
I try to make it work on a fresh Ubuntu Server 16.04.2 LTS.
Installation successful.
Redis-server is active
sudo service redis-server status
● redis-server.service - Advanced key-value store
Loaded: loaded (/lib/systemd/system/redis-server.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2017-03-17 18:57:18 MSK; 2 days ago
Docs: http://redis.io/documentation,
man:redis-server(1)
Main PID: 1147 (redis-server)
Tasks: 3
Memory: 2.0M
CPU: 3min 12.186s
CGroup: /system.slice/redis-server.service
└─1147 /usr/bin/redis-server 0.0.0.0:6379
Mar 17 18:57:18 geoip systemd[1]: Starting Advanced key-value store...
Mar 17 18:57:18 geoip run-parts[1085]: run-parts: executing /etc/redis/redis-server.pre-up.d/00_example
Mar 17 18:57:18 geoip run-parts[1148]: run-parts: executing /etc/redis/redis-server.post-up.d/00_example
Mar 17 18:57:18 geoip systemd[1]: Started Advanced key-value store.
What I do wrong?
I try to check redis connection
redis-cli
127.0.0.1:6379> ping
PONG
127.0.0.1:6379> exit
Seems it work...
How to make it work?
I build the map in my server some days.
But yesterday,I find the token have some problems.
It seems the token is out of time.
How can I use Mapbox and get a map same as yours with my own token.
Thanks!
Please can this be done on a raspberry pi 3....
Thanks
I created a new feature. I removed the first table, the one that shows the colors and the protocols, and added a new one in which the quantity and the target ip appear. Thus it is possible to know which network ips are more and / or less attacked.
Please Help on how to show the attacks on multiple destination IPs. Please share the codes if anyone solved it already !
Has happened to give error in the application when the amount of logs is very great and very fast. I have checked that the java script toLowerCase () function used to put flag images is to blame. I have adopted a simple solution here:
// var path = 'flags /' + args [i] .toLowerCase () + '.png';
Var path = 'flags /' + args [i] + '.png';
I removed toLowerCase () and used a shell script function to rename by capitalizing the acronyms of countries in the flags directory. Resolved for me.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.