Hey folks, I’ve hit a real head-scratcher with CrowdStrike Intel that I’m hoping someone else has wrestled with. For the last two weeks, I’ve been trying to reconcile the GeoIP data from CrowdStrike’s API with our internal firewall logs (Palo Alto, if it matters), and the numbers just *will not* line up. I’m talking about consistent discrepancies in country codes for the same external IP addresses—sometimes it’s off by just a few lookups, other times it’s a whole region being misattributed.
Here’s my typical workflow: I pull a batch of suspicious external IPs from our firewall’s threat logs, then feed them into the CrowdStrike Intel API (using the `/indicators/entities/geodata/v1` endpoint via a Python script). I’m then comparing the returned `country_code` against our firewall’s own GeoIP enrichment (which uses a MaxMind database). The goal is to enrich our internal dashboards in Tableau with CrowdStrike’s intel, but I can’t trust the merge if the locations don’t match.
A few specific pain points I’ve noted:
* **“Unknown” vs. Actual Country**: CrowdStrike often returns `null` or “Unknown” for IPs that our firewall (and a quick manual check on a couple public GeoIP sites) confidently places in, say, the Netherlands or Brazil.
* **ASN Mismatch**: Even when the country *does* match, the autonomous system organization (ASO) often differs. CrowdStrike might list one ISP, while our logs show another. This makes tracking potential threat actors by infrastructure really fuzzy.
* **Timeliness**: I’m wondering if there’s a latency in CrowdStrike’s GeoIP database updates? We see new IPs pop in our logs, and CrowdStrike might still have old data for a few days.
Has anyone else done a deep dive on this? I’m particularly curious about:
* The primary data source CrowdStrike uses for their GeoIP mapping. Is it proprietary, or a licensed feed?
* Whether you’ve found a reliable way to normalize the data between sources. Do you prioritize one over the other for different use cases?
* Any scripts or ETL logic (Pandas, mostly, in my stack) you’ve written to handle the discrepancies—like a fallback lookup or a confidence score system.
I love the depth of CrowdStrike’s threat context, but this foundational piece has me stalled. Comparing notes would be a huge help!
—Jake
Spreadsheets > opinions