需求：

(图片点击放大查看)

思路：

解决过程与步骤：

1、微步在线API接口文档

(图片点击放大查看)

(图片点击放大查看)

(图片点击放大查看)

2、curl命令测试

curl -v -X GET 'https://api.threatbook.cn/v3/scene/ip_reputation?apikey=API_KEY&resource=37.59.54.205'

(图片点击放大查看)

yum install jq -y
curl  -X GET 'https://api.threatbook.cn/v3/scene/ip_reputation?apikey=API_KEY&resource=37.59.54.205'| jq 

(图片点击放大查看)

3、GrayLog配置Lookup Tables

https://api.threatbook.cn/v3/scene/ip_reputation?apikey=API_KEY&resource=${key}

(图片点击放大查看)

(图片点击放大查看)

(图片点击放大查看)

{
  "data": {
    "37.59.54.205": {
      "severity": "low",
      "judgments": [
        "Scanner",
        "IDC"
      ],
      "tags_classes": [],
      "basic": {
        "carrier": "OVH SAS",
        "location": {
          "country": "France",
          "province": "Ile-de-France",
          "city": "Paris",
          "lng": "2.345101",
          "lat": "48.848483",
          "country_code": "FR"
        }
      },
      "asn": {
        "rank": 2,
        "info": "OVH, FR",
        "number": 16276
      },
      "scene": "",
      "confidence_level": "low",
      "is_malicious": true,
      "update_time": "2020-11-25 09:11:44"
    }
  },
  "response_code": 0,
  "verbose_msg": "OK"
}

(图片点击放大查看)

(图片点击放大查看)

接口地址：https://api.ipplus360.com/ip/geo/v1/city/
请求方式：HTTPS GET/POST
请求示例：https://api.ipplus360.com/ip/geo/v1/city/?key=您申请的key&ip=您需要查询的ip&coordsys=WGS84

(图片点击放大查看)

(图片点击放大查看)

最后针对以上API接口配置的LookupTable如下

(图片点击放大查看)

4、可以针对有公网IP字段调用以上接口并将查询结果保存为日志

Failed password for .* from(.+?)\s.?

(图片点击放大查看)

ip_geo_latitude Lookup Table
Trying to extract data from ssh_login_failed_ip into ssh_login_failed_ip_geo_latitude

ip_geo_longitude Lookup Table
Trying to extract data from ssh_login_failed_ip into ssh_login_failed_ip_geo_longitude

ip_geo_longitude Lookup Table
Trying to extract data from ssh_login_failed_ip into ssh_login_failed_ip_geo_longitude

(图片点击放大查看)

5、Pipeline配置

rule "GeoIP lookup: ssh_login_failed_ip"
when
  has_field("ssh_login_failed_ip_geo_latitude") and has_field("ssh_login_failed_ip_geo_longitude")
then
    let ip_geo_latitude = to_string($message.ssh_login_failed_ip_geo_latitude);
    let ip_geo_longitude = to_string($message.ssh_login_failed_ip_geo_longitude);
    let ip_location_temp1 =  concat(to_string(ip_geo_latitude),",");
    let ip_location_temp2 =  concat(ip_location_temp1, ip_geo_longitude);
    set_field("ssh_login_failed_ip_location", ip_location_temp2);
end

(图片点击放大查看)

ip_threatcheck_result
rule "IPThreatChecklookup: ssh_login_failed_ip"
when
  has_field("ssh_login_failed_ip")
then
    let ip_threatcheck_result = lookup("ipthreatcheck",to_string($message.ssh_login_failed_ip));
    debug (ip_threatcheck_result) ;
    set_field("ssh_login_failed_ip_threatcheck_result", ip_threatcheck_result);
end

(图片点击放大查看)

(图片点击放大查看)

6、配置DashBoard显示攻击IP的经纬度

(图片点击放大查看)

(图片点击放大查看)

(图片点击放大查看)

如上图所示：Zombie关键字搜索可以判定该攻击IP为僵尸傀儡机

地理位置为荷兰

Tips:

{
  "extractors": [
    {
      "title": "ip_geo_latitude",
      "extractor_type": "lookup_table",
      "converters": [],
      "order": 1,
      "cursor_strategy": "copy",
      "source_field": "ssh_login_failed_ip",
      "target_field": "ssh_login_failed_ip_geo_latitude",
      "extractor_config": {
        "lookup_table_name": "ipplus360_lat"
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "ip_geo_longitude",
      "extractor_type": "lookup_table",
      "converters": [],
      "order": 2,
      "cursor_strategy": "copy",
      "source_field": "ssh_login_failed_ip",
      "target_field": "ssh_login_failed_ip_geo_longitude",
      "extractor_config": {
        "lookup_table_name": "ipplus360_lng"
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "ip_threatcheck",
      "extractor_type": "lookup_table",
      "converters": [],
      "order": 3,
      "cursor_strategy": "copy",
      "source_field": "ssh_login_failed_ip",
      "target_field": "ssh_login_failed_ip_threatcheck",
      "extractor_config": {
        "lookup_table_name": "ipthreatcheck"
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "json_extractor",
      "extractor_type": "json",
      "converters": [],
      "order": 4,
      "cursor_strategy": "copy",
      "source_field": "ssh_login_failed_ip_threatcheck_result",
      "target_field": "",
      "extractor_config": {
        "flatten": false,
        "list_separator": ", ",
        "kv_separator": "=",
        "key_prefix": "ip_threatcheck_result_",
        "key_separator": "_",
        "replace_key_whitespace": false,
        "key_whitespace_replacement": "_"
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "ssh_login_failed_ip_extractor",
      "extractor_type": "regex",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "ssh_login_failed_ip",
      "extractor_config": {
        "regex_value": "Failed password for .* from(.+?)\\s.?"
      },
      "condition_type": "string",
      "condition_value": "Failed password "
    }
  ],
  "version": "4.2.10"
}