Add 'tags' to event model. Add a dataimport system - currently for MaxMind zip files

app/jobs/process_waf_analytics_job.rb

@@ -44,16 +44,20 @@ class ProcessWafAnalyticsJob < ApplicationJob
   end
 
   def analyze_geographic_distribution(event)
-    return unless event.country_code.present?
+    return unless event.has_geo_data?
 
-    # Check if this country is unusual globally
+    country_code = event.lookup_country
+    return unless country_code.present?
+
+    # Check if this country is unusual globally by joining through network ranges
     country_events = Event
-      .where(country_code: event.country_code)
+      .joins("JOIN network_ranges ON events.ip_address <<= network_ranges.network")
+      .where("network_ranges.country = ?", country_code)
       .where(timestamp: 1.hour.ago..Time.current)
 
     # If this is the first event from this country or unusual spike
     if country_events.count == 1 || country_events.count > 100
-      Rails.logger.info "Unusual geographic activity from #{event.country_code}"
+      Rails.logger.info "Unusual geographic activity from #{country_code}"
     end
   end