Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Enrichment

Rockfish NDR enriches flow data with geographic and reputation intelligence during ingestion.

GeoIP

Geographic location lookups via MaxMind GeoLite2 or GeoIP2 databases.

Enriched Fields

FieldDescription
dest_countryDestination country (ISO 3166)
dest_cityDestination city name
dest_as_orgDestination ASN organization
dest_asnDestination ASN number
dest_latitudeDestination latitude
dest_longitudeDestination longitude

Configuration

Add to rockfish.yaml (keys are flat under enrichment:):

enrichment:
  geoip_city_path: /opt/rockfish/geoip/GeoLite2-City.mmdb
  geoip_asn_path: /opt/rockfish/geoip/GeoLite2-ASN.mmdb

Requirements

  • MaxMind GeoLite2-City and GeoLite2-ASN databases
  • Free account at maxmind.com
  • Requires the geoip feature (enabled by default)
  • Available at all license tiers (GeoIP country/ASN enrichment is included from Basic)

IP Reputation

Abuse confidence scoring via the AbuseIPDB API.

Enriched Fields

FieldDescription
drepDestination abuse confidence score (0-100)
drep_reportsNumber of abuse reports
drep_ispISP/hosting provider
drep_domainDomain associated with the IP

Configuration

Flat keys under enrichment: in rockfish.yaml. The AbuseIPDB API key is not put in the YAML — set ABUSEIPDB_API_KEY in the environment file (/opt/rockfish/etc/rockfish.env):

enrichment:
  ip_reputation_enabled: true
  cache_ttl_hours: 48
  memory_cache_size: 50000
  lookup_timeout_ms: 200
  fail_open: false
  # Max AbuseIPDB lookups per UTC day (0 disables). Free tier allows 1,000/day.
  daily_lookup_budget: 900

# /opt/rockfish/etc/rockfish.env
ABUSEIPDB_API_KEY=your-key-here

Caching

IP reputation lookups are cached at two levels:

  1. Memory cache — LRU cache (default: 50,000 entries) for fast lookups
  2. Parquet cache — Persistent disk cache with configurable TTL

Requirements

  • AbuseIPDB API key (set in environment file)
  • Requires the ip_reputation feature (enabled by default)
  • Requires the Basic license tier or higher

MAC Vendor (OUI)

Resolve device MAC addresses to their hardware manufacturer using the public IEEE OUI registry. Vendor names enrich the Asset Inventory and DHCP-derived device metadata (a MAC’s first 24 bits identify the vendor).

Enriched Fields

FieldDescription
mac_vendorHardware manufacturer resolved from the MAC OUI prefix

Configuration

One flat key under enrichment: — MAC-vendor enrichment turns on when the file exists at oui_path:

enrichment:
  oui_path: /opt/rockfish/geoip/oui.csv

Download (and periodically refresh) the OUI database:

# Bundled helper:
./scripts/download-oui.sh

# …or directly from IEEE:
sudo curl -fsSLo /opt/rockfish/geoip/oui.csv https://standards-oui.ieee.org/oui/oui.csv

Requirements

  • The IEEE OUI CSV present at oui_path (refresh it periodically as vendors are added).
  • MAC addresses in the EVE stream (Suricata DHCP events / L2 metadata).
  • Pairs with Asset Inventory — vendor is shown per discovered device.

Report Integration

Both GeoIP and IP reputation data appear across multiple report pages:

  • Overview — Top countries by flow volume
  • Flows — Country breakdown with GeoIP data
  • Threats — IP reputation scores and flagged hosts
  • Network — Node detail panel with geographic info
  • World Map — Leaflet.js globe with country-level overlays

Note: GeoIP and IP reputation columns are only populated when the probe runs with those features enabled. Report queries gracefully return zero rows when enrichment data is absent.