2 Replies Latest reply on Sep 8, 2016 7:06 AM by riccip

    Variable CORP_GEOS

    riccip

      it states "Description: Customize this variable to identify your Corporation's Geolocations.  It is set to United States on default."

      does anyone know where I can get more information on the format used in the SIEM?

       

      I have found entries from the event windows and added them and still get alerts for the same entries, I have finally tuned the rule using it off..

       

       

      Cheers,

      Riccip

        • 1. Re: Variable CORP_GEOS
          rth67

          While in Policy Editor > Varilable > Reputation > CORP_GEOS > select the Funnel to select your corporations Geo Locations. CTRL+Click will allow for multiple locations.

           

          Are you using Zone's with Geo-Locations set for your locations, if using private address space? This will allow you to specify by IP Range, and then set the Geo-Location information.

          2 of 2 people found this helpful
          • 2. Re: Variable CORP_GEOS
            riccip

            Way to easy, thanks ..

             

            Yes we are using Zones and private IP ranges..

             

            Cheers,