cancel
Showing results for 
Search instead for 
Did you mean: 
riccip
Level 7

Variable CORP_GEOS

it states "Description: Customize this variable to identify your Corporation's Geolocations.  It is set to United States on default."

does anyone know where I can get more information on the format used in the SIEM?

I have found entries from the event windows and added them and still get alerts for the same entries, I have finally tuned the rule using it off..

Cheers,

Riccip

0 Kudos
2 Replies
rth67
Level 12

Re: Variable CORP_GEOS

While in Policy Editor > Varilable > Reputation > CORP_GEOS > select the Funnel to select your corporations Geo Locations. CTRL+Click will allow for multiple locations.

Are you using Zone's with Geo-Locations set for your locations, if using private address space? This will allow you to specify by IP Range, and then set the Geo-Location information.

riccip
Level 7

Re: Variable CORP_GEOS

Way to easy, thanks ..

Yes we are using Zones and private IP ranges..

Cheers,

0 Kudos