Admin Guide

Synapse-Spur Admin Guide

Configuration

Synapse-Spur requires a Spur API key. For information on how to sign up, please visit the Spur website.

Setting API key for global use

To set-up a global API key:

> spur.config.add default myapikey
Synapse-Spur config "default" added

Creating a configuration for role-based use

Add an unscoped configuration:

> spur.config.add myunscoped myapikey --scope unscoped
Synapse-Spur config "myunscoped" added

Grant another user admin permissions to the new configuration:

> spur.config.update myunscoped --perm user visi admin
Updated Synapse-Spur config "myunscoped"

Grant a role read permissions to the new configuration:

> spur.config.update myunscoped --perm role ninjas read
Updated Synapse-Spur config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the spur.ipcontext command.

Setting the tag prefix

The tag prefix used when recording data from Spur defaults to rep.spur. It may be set per configuration using the --tag-prefix option to spur.config.add or spur.config.update, or for all configurations using spur.config.migrate:

> spur.config.migrate --tag-prefix my.prefix
Updated Synapse-Spur config "synapse-spur:myunscoped"

Setting the base URL

The base URL of the Spur API defaults to https://api.spur.us. The IP context API path /v2/context/<addr> is appended to it. It may be set per configuration using the --baseurl option to spur.config.add or spur.config.update, or for all configurations using spur.config.migrate:

> spur.config.update myunscoped --baseurl https://mirror.my.domain/spur
Updated Synapse-Spur config "myunscoped"

Setting the node property set behavior

The node property set behavior is a global setting which applies to all users and configurations. It may be listed and changed using the spur.setup.prop.behavior command:

> spur.setup.prop.behavior --list
Defined/configured property set behaviors:

  Property           | Behavior
  ------------------ | --------
  inet:asn:owner     | always

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.spur.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Permissions

Package (synapse-spur) defines the following permissions:
power-ups.spur.user              : Controls user access to Synapse-Spur. ( default: false )
power-ups.spur.admin             : Controls access to Synapse-Spur admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.spur.user
Added rule power-ups.spur.user to user visi.

or:

> auth.role.addrule ninjas power-ups.spur.user
Added rule power-ups.spur.user to role ninjas.

Workflows

Synapse-Spur provides the following workflows in Optic:

Title: Configuration

The Configuration workflow may be used to manage Synapse-Spur configurations from Optic.

Node Actions

Synapse-Spur provides the following node actions in Optic:

Name : ipcontext
Desc : Query the Spur API for IP context data.
Forms: inet:ipv4, inet:ipv6

Onload Events

Synapse-Spur uses an onload event to create the following extended properties:

_spur:organization (The organization operating this IP.)
_spur:infrastructure (The primary type of infrastructure this IP supports.)
_spur:client:count (The average number of clients Spur observes daily on this IP.)
_spur:client:spread (The total geographic area (in square kilometers) where Spur has observed users for this IP.)
_spur:client:countries (The number of countries where Spur has observed clients in for this IP.)
_spur:client:concentration:loc (The strongest location where Spur has observed clients using this IP.)
_spur:client:concentration:density (The percentage of clients on this IP observed in the concentrated location, versus other locations.)
_spur:client:concentration:skew (The straight line distance from the top level IP location.)
_spur:client:concentration:geohash (The geohash of the concentration area.)