Include geolocation data in Zeek logs generated from pcaps

[philrz]

A community member suggested on Slack:

if you can add the country codes alongside every IP in the conn logs,it can make something more easy.

Research showed that enabling Zeek's GeoLocation support is not too difficult. The Zeek package geoip-conn has been created to easily enable this in our Zeek artifact that's bundled with the Brim app. The work linked to this issue will be to have Brim use this newer artifact so the geo fields will be populated on Zeek logs generated when opening pcaps in the app. If/when resources allow, we may later choose to add some "map" visualizations that leverage this data, but that would be tracked by separate issue(s).

[philrz]

Verified in Brim commit 1241dec (which includes the Brim Zeek tagged v3.2.0-dev-brim4) talking to zqd commit 52e2178. A wrccdc pcap was dragged into the app, and here we see the geolocation data populated in a conn record.

As spotted by @mikesbrown, the Brim app is currently not including the top-level geo. in the field references, so this is being tracked in #933.

[omnidepp]

Any chance this could be extended to use zeek's built-in mmdb_check_asn to also lookup the autonomous_system_organization for each IP address with the free Geoip2 ASN database?

[philrz]

@omnidepp: I've opened up a separate issue at brimdata/geoip-conn#39 to track your request.