Splunk has this capability via its Google Maps addon that allows you to map ip addresses that show up in your syslog. That way you can pinpoint geo locations of attacks such as scans.
Do you guys have any suggestions as to if and how this can be done with just a regular syslog server such as syslog-ng or a syslog software collecting the logs? How would you go about performing reverse lookups on the syslogs?
We have an ASA device that we want to analyze syslogs from to get a better idea about the location of external attacks.
Thank you kindly.