# Elastic SIEM Map Not Showing Destinations

**URL:** <https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436>\
**Category:** SIEM\
**Created:** [August 1, 2020, 9:03pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436 "2020-08-01T21:03:45Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [August 1, 2020, 9:03pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/1 "2020-08-01T21:03:45Z")

</div>

I have not been able to find any information about this issue. Also, I am very new to the elastic stack.  
When I look at the SIEM map, it shows some of the destination icons and information but a large amount of destination lines do not have an icon or any further information about the destination.

![Map_destinations](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b19ff17489a2fac1d13fb8e69292ea7369c5033a.png)

I am using the ealsticsearch pipeline to enrich my logs with geoip data as seen in here: [https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-3-geoip-data-and-beats-config-review](https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-3-geoip-data-and-beats-config-review)

Any help, guidance, or direction to further reading would be greatly appreciated.

Thank you.

---

<div class="post-metadata">

**Author:** ![stephmilovic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephmilovic/32/146835_2.png) [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)\
**Post date:** [August 3, 2020, 1:06pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/2 "2020-08-03T13:06:38Z")

</div>

Hi Arron,

Welcome to the Elastic stack. Thank you for reaching out! My recommendation would be to follow this documentation and make sure that all of your source and destination geo data is mapped correctly: [https://www.elastic.co/guide/en/siem/guide/current/conf-map-ui.html](https://www.elastic.co/guide/en/siem/guide/current/conf-map-ui.html)

There is also a blog post about this feature. There is a gif that shows what you should be seeing: [https://www.elastic.co/blog/integrating-maps-into-elastic-siem](https://www.elastic.co/blog/integrating-maps-into-elastic-siem)

Please let me know if you are able to get this working. If you have trouble, posting your mappings.json would be helpful. Thanks!

Steph

---

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [August 3, 2020, 8:06pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/3 "2020-08-03T20:06:13Z")

</div>

Steph,

Thank you for the response.  
I went through that first blog post you mentioned and I believe I have everything set up properly.

I am not sure what mappings.json you would like to see. The following are the ones on my server:

```auto
/usr/share/kibana/src/legacy/core_plugins/kibana/mappings.json
/usr/share/kibana/src/legacy/core_plugins/timelion/mappings.json
/usr/share/kibana/x-pack/legacy/plugins/maps/mappings.json
/usr/share/kibana/x-pack/plugins/actions/server/saved_objects/mappings.json
/usr/share/kibana/x-pack/plugins/alerting/server/saved_objects/mappings.json
/usr/share/kibana/x-pack/plugins/event_log/generated/mappings.json
/usr/share/kibana/x-pack/plugins/lists/server/services/items/list_item_mappings.json
/usr/share/kibana/x-pack/plugins/lists/server/services/lists/list_mappings.json
/usr/share/kibana/x-pack/plugins/task_manager/server/saved_objects/mappings.json

```

I do have some entries that look like this:  
Date/Time destination.ip destination.geo.location source.ip source.geolocation

```auto
Aug 3, 2020 @ 14:21:51.035	255.255.255.255 - 192.168.0.19	{
  "lon": ******** ,
  "lat": *********
}

```

I appears that broadcast addresses and loopback address does not get the geoip data when  
when.network.destination.ip: private  
when.network.source.ip: private

Would this cause this type of an issue?

---

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [August 4, 2020, 3:30pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/4 "2020-08-04T15:30:03Z")

</div>

Steph,

I spoke with James Spiteri on the Slack channel who explained how to get what you requested. 😃

As there is a character limit for each post, I have the packetbeat mapping in pastebin. Please let me know if this is not acceptable.

> **[Man715\_PacketBeat\_mappings - Pastebin.com](https://pastebin.com/QJpRDfF9)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

---

<div class="post-metadata">

**Author:** ![nicpenning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicpenning/32/36366_2.png) [@nicpenning](https://discuss.elastic.co/u/nicpenning)\
**Post date:** [August 5, 2020, 3:29pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/5 "2020-08-05T15:29:50Z")

</div>

I have noticed this issue as well. Depending on zoom levels some data shows and some does not.

 ![magic](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f89b40ed4b2b39ce2e46e611751ca8782c008d96.gif)

This has been consistent since day 1 of the feature.

I finally have a way of actually showing it, as seen above.

All geo point data exists, it just seems like it doesn't quite render fully. Happy to provide more details, please let me know.

This is WinLogBeat data via SysMon and process network connections.

---

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [August 5, 2020, 8:31pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/6 "2020-08-05T20:31:31Z")

</div>

Yeah, I am also able to see the destination bytes for each path even though it eventually disappears and I never get to see the destination IP.

 ![map_data](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7bb83ba85c64a6664b9d23609989ba324f638267.gif)

Also, did you change the icons? I have pink dots for destination and a blue house for the source, which I really would like to change.

---

<div class="post-metadata">

**Author:** ![nicpenning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicpenning/32/36366_2.png) [@nicpenning](https://discuss.elastic.co/u/nicpenning)\
**Post date:** [August 5, 2020, 8:33pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/7 "2020-08-05T20:33:57Z")

</div>

I was not in the SIEM app. I was using the Maps visualization and created my own layers.

---

<div class="post-metadata">

**Author:** ![Man715](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/man715/32/73182_2.png) [@Man715](https://discuss.elastic.co/u/Man715)\
**Post date:** [August 5, 2020, 8:48pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/8 "2020-08-05T20:48:48Z")

</div>

Gotcha

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 2, 2020, 8:48pm UTC](https://discuss.elastic.co/t/elastic-siem-map-not-showing-destinations/243436/9 "2020-09-02T20:48:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.