Splunk geoPhone

geoPhone provides a "phonelocation" macro like Splunk's "iplocation" but based on Phone Number instead of IP Address

Comment

AS DIRECTED BY CONTEST MANAGER I AM PLACING THIS NOTE HERE SO THAT THIS APP WILL BE ENTERED INTO ALL THREE OF THE FOLLOWING CATEGORIES:

  • Insider Threat and Fraud
  • Social Impact
  • Innovation

Inspiration

Splunk's ever-expanding support for geomapping IP addresses really got me thinking about doing the same thing for phone numbers. When they came out with the geostats command, I knew that I had to make it happen.

How it works

Challenges I ran into

The main challenge for a project that use other people's data is in data validation and normalization. You would not believe how often countries split, merge, change names, or have multiple common aliases. I had a decent lookup created pretty quickly but it took me weeks of merging, cross-referencing, and massaging the data before I had something that I felt was pretty accurate and usable.

Accomplishments that I'm proud of

Not only is my app helping me show my clients things they have never been able to see, but it has also allowed me to uncover mistakes in publicly available databases. For example, one of my sources is "http://opengeocode.org/download/countrynames.txt" and it turns out that this file is missing both "Netherlands Antilles" and "The Republic of South Sudan". I will be notifying them of this mistake and I am excited that I will be "giving back" to them after what they helped me to create.

What I learned

There are a HUGE number of callers that spoof ANI (CLID)! Also, don't ever trust that a public DB is correct; ALWAYS cross-reference against multiple sources and assume that errors will be found. Never put it past technical organizations to get their political digs in while doing tech work; I am astounded that there is a "country" with the official name of "Occupied Palestinian Territory". I knew that I cannot trust the UN but I thought I could trust ISO!

What's next for Splunk geoPhone

Right now the "Regions" that work well are the Provinces of Canada and the States of the USA. This is mostly because these are the easiest and most popular in my dataset but also because it is extremely difficult to find intra-country area code dialing plans. I would like to add support for UK cities and other countries, too.

Built With

Share this project:

Updates