Queries/

Geolocate via ipapi.co

Zach Wasserman

Geolocate a host using the [ipapi.co](https://ipapi.co) in an emergency. Requires the curl table. [Learn more](https://fleetdm.com/guides/locate-assets-with-osquery).

To learn more about queries, check this guide.

Query PowerShellNEW BashNEW

SELECT JSON_EXTRACT(result, '$.ip') AS ip, JSON_EXTRACT(result, '$.city') AS city, JSON_EXTRACT(result, '$.region') AS region, JSON_EXTRACT(result, '$.country') AS country, JSON_EXTRACT(result, '$.latitude') AS latitude, JSON_EXTRACT(result, '$.longitude') AS longitude FROM curl WHERE url = 'http://ipapi.co/json';

$uri = 'http://ipapi.co/json'
try {
    $response = Invoke-RestMethod -Uri $uri
    $result = [PSCustomObject]@{
        ip        = $response.ip
        city      = $response.city
        region    = $response.region
        country   = $response.country
        latitude  = $response.latitude
        longitude = $response.longitude
    }
    $result | Format-Table -AutoSize
}
catch {
    Write-Error "Failed to retrieve data from $uri`n$($_.Exception.Message)"
}