I have set to use IP GTI reputation + src ip country but there is no src country value in event. Is there way to display/verify if IPS sensor send/receive any requests to/from GTI cloud ?
What is correct way to setup ip src country and gti ip reputation ?
even I configured GTI connection and IPS is connected to TrustedSource.org, there is no src country data in attack details.
What can be wrong ? Any ideas, please ?
on IPS I can see:
>show gti stats ip
GTI server connection status is ok
[GTI Query Statistics]
Query sent count :409584
Query received count :5595