Geolocation detection anomaly: how to fix it?

[mauro....@cmcc.it]

Dear Users,

during a penetration test, I noticed the source public IP I was using is not correctly detected by the Geolocator. 

I tried to check the source IP location using https://www.iplocation.net/ip-lookup website and … surprise!
The same IP address seems to be detected in different italian areas by the different geolocators shown in the web page mentioned above. The wrong one is Milan

Geolocation data from DB-IP gives the wrong answer (Milan)
Geolocation data from IP2Location gives the right answer (because I know where is located the srcip public iP :-) )

Question: is there a way to change the geolocator used by Wazuh?

[Sebastian Dario Bustos]

Hi Mauro,
Thank you for using Wazuh!!!

I'll investigate this further and let you know.

Regards.

[Mauro Tridici]

Hi Sebastian, 

Thank you for taking care of my case. 

Have a great day. 

Mauro

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/XxB9kWMqv1o/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/8860d436-6ca1-4bdd-a6b3-dbcaead646e9n%40googlegroups.com.

[Mauro Tridici]

Hello Sebastian,

I’m sorry to disturb you again, but I only would like to know if you had the time to identify a solution for my case.

Many thanks again.

Have a great day,

Mauro

[Sebastian Dario Bustos]

Hello Mauro,

Unfortunately this change is only possible with just a configuration since the integration with GeoIP is coded in wazuh-analysisd: decoder.c. We can only change the provider by implementing a new integration in the code.

On the other hand, if this is not a data you need to catch / analyze with the rules but just to increase the amount of data shown on the Dashboard alert you can check this:

How to use IP2Location filter plugin with Elastic Stack.

Let me know.

Regards.

[Mauro Tridici]

Hello Sebastian,

many thanks for your help and for the time you spent for my case.

Anyway John Soliani provided me a workaround to fix my issue.

You can find the instructions here: https://groups.google.com/g/wazuh/c/PYOjFtZ6K9o/m/pSpw-QHiAAAJ

Have a great day.

Regards,

Mauro

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/b147a99b-64cf-4f19-978d-6ab95191bc71n%40googlegroups.com.

[Sebastian Dario Bustos]

Hi Mauro,

Oh, ok, yes, to update it, ok, glad it worked!