GeoIP Plugin - Offer Expanded MaxMind Data
andrewvc opened this issue · 1 comments
andrewvc commented
Moved from elastic/logstash#9202 , original issue by @ubhackn
For really quick and easy security analysis of IP data, it would be helpful if the existing geoip plugin could include the GeoIP Anonymous IP database from MaxMind such that we don't need to purchase and maintain the license with them directly. Having a field like geoip.proxy_name would allow for highlighting of traffic from known proxy/anonymizer IPs (like TOR), which we can then use as an additional data point for threat detection.
jsvd commented
from what I understand the GeoIP Anonymous IP database is a commercial offering from Maxmind, so we won't be releasing it with Logstash which is an open source project.