Skip to content

Allow user to replace the Geolocation database #955

@philrz

Description

@philrz

As described in the geoip-conn README, the included GeoLite2 database is known to be less accurate than the paid GeoIP2 version. MaxMind's FAQ claims that their paid version should work as a "drop-in replacement".

In its current form, the geoip-conn package is effectively "hard-wired" to use just its included database, and Brim installs geoip-conn atop its embedded Zeek as-is. While a user could manually swap out the included database, when they later upgrade Brim, the configuration would effectively revert to using the free GeoLite2 database again.

One way for a user to avoid this would be if they were using Brim's customized Zeek option, such that pcap processing would always be done with a separate Zeek that the user has wired up with the paid database. However, for users that aren't using this approach, it might be useful if Brim provided a way to still use its embedded Zeek, but with a persistent pointer to a non-default database. This could perhaps be done at the level of the geoip-conn package itself, or perhaps with just a "preference" setting within Brim.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions