Forum Discussion

Brass Contributor

Mar 12, 2020

Solved

Country names in maps

I'm trying to map out the malicious IPs attempting connections to our ASA. It works in Log Analytics with this query: CommonSecurityLog | where isnotempty(MaliciousIP) | summarize count() by ...

GaryBushey
Mar 13, 2020
endakelly It sounds like you know which country codes are causing the issues and what they should be. You could do a mapping in your KQL to fix just those issues if there are not that many using a case statement like:

extend MaliciousCountry = case(MaliciousIPCountry == "PRC, "PR", MaliciousIPCountry == "Korea, "KR", MaliciousIPCountry)

This will do the translation for those countries that need it or else just return the country code if no translation is needed.

(I have no clue what the real country codes should be but hopefully this gets the point across)

GaryBushey

Bronze Contributor

Mar 13, 2020

endakelly It sounds like you know which country codes are causing the issues and what they should be. You could do a mapping in your KQL to fix just those issues if there are not that many using a case statement like:

extend MaliciousCountry = case(MaliciousIPCountry == "PRC, "PR", MaliciousIPCountry == "Korea, "KR", MaliciousIPCountry)

This will do the translation for those countries that need it or else just return the country code if no translation is needed.

(I have no clue what the real country codes should be but hopefully this gets the point across)

endakelly

Brass Contributor

Mar 16, 2020

GaryBushey works a treat. Slight syntax error in what you've got here but I was able to correct it.

CommonSecurityLog

| where isnotempty(MaliciousIP)

| extend MaliciousIPCountry = case(MaliciousIPCountry == "People's Republic of China", "CN", MaliciousIPCountry == "Korea", "KR", MaliciousIPCountry)

| summarize count() by MaliciousIPCountry

Thanks