2 Replies Latest reply on Sep 8, 2016 7:06 AM by riccip

    Variable CORP_GEOS


      it states "Description: Customize this variable to identify your Corporation's Geolocations.  It is set to United States on default."

      does anyone know where I can get more information on the format used in the SIEM?


      I have found entries from the event windows and added them and still get alerts for the same entries, I have finally tuned the rule using it off..





        • 1. Re: Variable CORP_GEOS

          While in Policy Editor > Varilable > Reputation > CORP_GEOS > select the Funnel to select your corporations Geo Locations. CTRL+Click will allow for multiple locations.


          Are you using Zone's with Geo-Locations set for your locations, if using private address space? This will allow you to specify by IP Range, and then set the Geo-Location information.

          2 of 2 people found this helpful
          • 2. Re: Variable CORP_GEOS

            Way to easy, thanks ..


            Yes we are using Zones and private IP ranges..