GeoIP

Since v1.39.0. IP indicators carry the country of their address or network (ISO code, e.g. CZ) from MaxMind GeoLite2 Country. Exports and groups can filter by it.

Setup

1. Create a free MaxMind account and a license key (Account → Manage License Keys).
2. Set CONFIG_GEOIP_LICENSE_KEY and CONFIG_GEOIP_ACCOUNT_ID (see Configuration) and restart the worker.

The worker downloads the database on its first start and then on CONFIG_GEOIP_SCHEDULE (default Wednesday and Saturday 5:30 – MaxMind publishes on Tuesdays and Fridays). geoip:update in the CLI updates it right away. Without a license key nothing is downloaded and indicators have no country.

An update replaces the networks in one transaction – a failed or broken download keeps the previous data – and then recomputes the country of the IP indicators in batches (about 20 s per 100,000 indicators). Rows a running fetch holds locked are skipped and tried again; any still locked keep their country until the next update (the worker log and geoip:update report them). New indicators get their country when they are stored.

Which country an indicator gets

• An address gets the country of the GeoIP network it lies in.
• A network gets a country when all GeoIP networks it overlaps have the same one; one spanning several countries (e.g. a big /8) gets none.
• Addresses MaxMind doesn't know (private ranges, unassigned space) and domains, URLs and JSON indicators have no country.

Filters

Where	Keep only these countries	Drop these countries
Export (incl. groups)	?country=CZ,SK	?exclude_country=CN,RU
Group (API)	countries	excludeCountries
group:create/group:update, indicators:export (CLI)	--countries CZ,SK	--countries '!CN,!RU'
tis-pull.sh	--country CZ,SK	--exclude-country CN,RU
GUI – Groups, Export	Only countries	Except countries

The filters apply to IP indicators only – domains, URLs and JSON pass. An IP without a known country is dropped by a "keep only" filter but passes a "drop" filter. A group's filter and the request's both apply; the group blacklist is never filtered.

Where the country shows

• GUI: the Country column and filter of the Indicators page (click a flag to filter by it), the country of the looked-up address and its matches in Is it listed? on the Dashboard.
• API: country of every indicator, GET /api/v1/indicators?country=CZ, GET /api/v1/indicators/countries (countries with counts), query.country and matches[].country of the lookup – see API Reference.
• CLI: indicators:print --country CZ and the Country column of indicators:print and indicators:search.
• CSV export: the last column, country.

Attribution

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. The data is subject to the GeoLite2 EULA.