Geolocation information data incorrect workaround

[dan1001]

Has anyone been able to come up with a workaround for Geolocation data being out of date in ESM? We do not take on prem upgrads frequently and run into issues with geolocations being incorrect or non populated for events and generating false positives.

[pbpillai]

We have released hotfixes yesterday for the issues related to incorrect information in Geo IP that the customers are facing.

Please contact McAfee Technical Support by opening a service request to get the hotfixes.

Regards,

Prashanth B Pillai

McAfee Technical Support

Customer Success Group

[lratcliffe]

In addition to the hotfixes for situations where you know the geolocation has updated but the SIEM has not updated it yet (or especially for private IPs where you need to have geolocation) then this is a good use case for Zones and SubZones.  With Subzones you can assign a range of IPs to a specific geolocation, including private ips.