Skip to main content
Question

Anyone do anything with ASN enrichment?

  • March 11, 2025
  • 8 replies
  • 13 views

Anyone do anything with ASN enrichment?

8 replies

  • Author
  • Employee
  • March 11, 2025

I see the Maxmind GeoLite2 database has it, but I don't think the GeoIP function does it?


Raanan Dagan
  • Employee
  • March 11, 2025

Try to download the GeoLite2-ASN.mmdb file


Raanan Dagan
  • Employee
  • March 11, 2025

It seems like it contains the correct info. See screenshot


Raanan Dagan
  • Employee
  • March 11, 2025

Based on the Cribl docs, I just see a reference to mmdbhttps://docs.cribl.io/stream/geoip-function


  • Author
  • Employee
  • March 11, 2025

Is the mmdb or csv preferred?


  • Author
  • Employee
  • March 11, 2025

Correct, I have two options for ASN data with maxmind: CSV or MMDB, does Cribl have any testing on which one could be quicker?


Raanan Dagan
  • Employee
  • March 11, 2025

I can only suspect the difference is minor .. in both cases the lookup will be loaded to the worker processes memory, so it should be fast regardless


  • Author
  • Employee
  • March 11, 2025

Thanks!