Enriching Data with Anomali GeoIP

The Anomali GeoIP enrichment provides geographical information on IP observables and their associated ISPs. You can leverage Anomali GeoIP from the Explore pivoting tool after activation.

Anomali GeoIP enables the following data transformations:

• IP to All
• IP to ASN
• IP to City Name
• IP to Connection Type
• IP to Continent Name
• IP to Country Name
• IP to ISP
• IP to ISP Country Name
• IP to Longitude
• IP to Org Name
• IP to Postal Code
• IP to Region Name
• IP to Time Zone

Executing the IP to All transformation runs all GeoIP transformations and returns all available data.

To activate the Anomali GeoIP enrichment:

1. Navigate to ThreatStream > APP STORE > APP Store.

2. Locate the Anomali GeoIP enrichment.

3. Click Get Access on the Anomali GeoIP tile.
4. On the window that opens, click Activate.

The Anomali GeoIP enrichment is now active.