ESM uses the Local Networksetting (also called Homenet in ESM 9.3.x and earlier versions) to identify IP addresses that are considered to be “inside” your enterprise network. This variable is used in a wide range of correlation rules and other ESM components to differentiate between inbound and outbound traffic. It's important to configure this setting properly in order for rules and other SIEM features to operate properly.
To configure Local Network:
Open the Asset Manager
Select the Network Discovery tab and click Local Network (Homenet in previous versions of ESM 9.3.x and earlier)
Enter the IP ranges that define your internal network. Local Network is defined as a comma-separated list of IP addresses and/or IP ranges. Click OK to save.