Geolocation map office 365 Not Working

[Atlas Atlas]

Hello can someone help,

i have configured office365 in Wazuh, but Geolocation Not Working

this is the code :

[root@wazuh-server ~]# vi /usr/share/filebeat/module/wazuh/alerts/ingest/pipeline.json
        "field": "data.srcip",
        "target_field": "GeoLocation",
        "properties": ["city_name", "country_name", "region_name", "location"],
        "ignore_missing": true,
        "ignore_failure": true
      }
    },
    {
      "geoip": {
        "field": "data.win.eventdata.ipAddress",
        "target_field": "GeoLocation",
        "properties": ["city_name", "country_name", "region_name", "location"],
        "ignore_missing": true,
        "ignore_failure": true
      }
    },
    {
      "geoip": {
        "field": "data.gcp.jsonPayload.sourceIP",
        "target_field": "GeoLocation",
        "properties": ["city_name", "country_name", "region_name", "location"],
        "ignore_missing": true,
        "ignore_failure": true
      }
    },
    {
      "date": {
        "field": "timestamp",
        "target_field": "@timestamp",
        "formats": ["ISO8601"],
        "ignore_failure": false
      }
    },
    {
      "date_index_name": {
        "field": "timestamp",
        "date_rounding": "d",
        "index_name_prefix": "{{fields.index_prefix}}",
        "index_name_format": "yyyy.MM.dd",
        "ignore_failure": false
      }
    },
    { "remove": { "field": "message", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "ecs", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "beat", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "input_type", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "tags", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "count", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "@version", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "log", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "offset", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "type", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "host", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "fields", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "event", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "fileset", "ignore_missing": true, "ignore_failure": true } },
    { "remove": { "field": "service", "ignore_missing": true, "ignore_failure": true } }
  ],
  "on_failure" : [{
    "drop" : { }
  }]
}

[Juan Nicolás Asselle (Nico Asselle)]

Hi,

Could you please share with us your Wazuh Manager version? Office365 geolocation enrichment is enabled by default since Wazuh v4.3.0 (PR), but a deployment bug makes this available since v4.3.2.
In case you want to fix this manually, you can add the next node (with the same JSON hierarchy) to /usr/share/filebeat/module/wazuh/alerts/ingest/pipeline.json

{ "geoip": { "field": "data.office365.ClientIP", "target_field": "GeoLocation", "properties": ["city_name", "country_name", "region_name", "location"], "ignore_missing": true, "ignore_failure": true } }

And then run

filebeat setup --pipelines systemctl restart filebeat

Hope this helps!
Regards,
Nicolas

​

[Atlas Atlas]

Hello Juan,

I have App Version : 4.3.10

i tried to add the code you share.

and restart service but still same things.

[Juan Nicolás Asselle (Nico Asselle)]

Hi again,

This template is executed during alert ingestion, only enriching with geolocation the new alerts. Could you please check if newer alerts have their GeoIP information?

[Atlas Atlas]

Hello Juan,

Thank you a lot, Finally it's Working