Displaying GEO coordinates via Information Floater

Robert Ullrich08. Aug 2018 | Best PracticesConsultingCyber Security

One of the features of “STORM powered by OTRS” is the information floater which allows to search for patterns in an article of a ticket. The feature was designed to enrich the content of a ticket without having to add static content to it. The main use case is to give security teams valuable information at a glance without the need to lookup the information in a separate browser tab.

Out of the box the possibility to search for CVE numbers is available via the Sysconfig settings in Ticket->Ticket::Frontend::ZoomCollectMetaFilters###CVE-Google and Ticket->Ticket::Frontend::ZoomCollectMetaFilters###CVE-Mitre. Last time I wrote a blog article, where I described how to request information for a IP address from NeutrinoAPI. An additional use case, which I had to solve lately was to check the GEO coordinates of a IP address.

Highlighting GEO coordinates in the TicketZoom

The first action was to add an additional ZoomCollectMetaFilter which would match on GEO coordinates. Because the SysConfig structure has changed in  OTRS 6, the example Jens showed you in 2010 will not work, I had to create a new XML file in “Kernel/Config/Files/XML” called “Floater.xml” using the new SysConfig structure with the following content:

<?xml version="1.0" encoding="utf-8" ?>
<otrs_config version="2.0" init="Framework">
<Setting Name="Ticket::Frontend::ZoomCollectMetaFilters###IP-GeoLocation" Required="0" Valid="0">
<Navigation>Frontend::Agent::View::TicketZoom</Navigation>
<Value>
<Hash>
<Item Key="RegExp">
<Array>
<Item>Long: \s* ( [-]* \d{1,3} \. \d{1,4} ) \s* Lat: \s* ([-]* \d{1,3} \. \d{1,4} )</Item>
</Array>
</Item>
<Item Key="Meta">
<Hash>
<Item Key="Name">IP-GeoLocation</Item>
<Item Key="URL">https://maps.google.com/maps?q</Item>
<Item Key="URLPreview">geolocation.pl?coordinates</Item>
<Item Key="Target">_blank</Item>
</Hash>
</Item>
</Hash>
</Value>
</Setting>
</otrs_config>

After I added this XML  file to STORM, I had to run the following script as OTRS user:

bin/otrs.Console.pl Maint::Config::Rebuild

STORM will now show the found GPS coordinates in TicketZoom, if the regular expression matches.

InformationFloater TicketZoom

My PERL script

Now I can create my PERL script in “bin/cgi-bin” called geolocation.pl. I also attached the file at the end of this article:

InformationFloater PERLKeep in mind, that this script has to be executable:
chmod +x bin/cgi-bin/geolocation.pl

Output

The Floater will now display the GPS coordinates in Google Maps. I also tried with OpenStreetMaps, but I faced some issues with the zoom within the floater.

InformationFloater TicketZoom with script

I would really like to see your use cases and ideas to use the Information Floater of “STORM powered by OTRS“, so please leave a comment.

Geolocation.pl script

You can download my script here.

Your email address will not be published. Required fields are marked *

This site uses cookies. By continuing to use the site, you agree to the use of cookies. More information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close