Categorization of Addresses

[captain118]

I'm new to security onion and have recently set it up at home. I've been wondering if there is there a way to add categorization of ip addresses to security onion? It would be nice if I could at a glance know if a particular address is associated with C&C, porn, malware, etc.

[reyesj2]

This is not a direct feature of Security Onion, but what you could do is ingest data from say MISP or AbuseCH through an elasticagent integration.
https://docs.securityonion.net/en/2.4/elastic-fleet.html?highlight=integration#adding-an-integration
You'd then have to setup an enrich policy, but from that you could do what you're looking for and have IPs get mapped to any hits in AbuseCH or MISP threat intel.

https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest-enriching-data.html