https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/what-populates-device-last-connected-source-city/m-p/589345#M535 <P>What populates&nbsp;device_last_connected_source_city&nbsp; field in the strata cloud manager , as presented via insights ?</P> <P>On the main dashboard that shows the world map , it shows device locations , are those from client side GPS via the GP agent, or just the locations correlated by the ISP ownership of the presented IP address ?&nbsp; &nbsp; &nbsp;It seems inconsistent , often grouping users to locations that arent where the users are ?&nbsp; &nbsp; When i look at the raw data in&nbsp;device_last_connected_source_city&nbsp; &nbsp;, sometimes that data isn't even populated and thus arent reflected on the dashboard map , hence question as to what and when is that information populated .</P> <P>On the dashboard it seems to be some level of aggregated GPS position , though in the data from insights it only provides the "city" field , not any actual GPS .&nbsp; Also strange that its city , seems more Region , as those in Towns are aggregated to closest region City or nothing.</P> <P>Just after abit more info as to how this data is made up , so it can be determined if it can be used in threat modelling</P> Wed, 12 Jun 2024 02:31:15 GMT M.Bathgate 2024-06-12T02:31:15Z https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/what-populates-device-last-connected-source-city/m-p/589345#M535 <P>What populates&nbsp;device_last_connected_source_city&nbsp; field in the strata cloud manager , as presented via insights ?</P> <P>On the main dashboard that shows the world map , it shows device locations , are those from client side GPS via the GP agent, or just the locations correlated by the ISP ownership of the presented IP address ?&nbsp; &nbsp; &nbsp;It seems inconsistent , often grouping users to locations that arent where the users are ?&nbsp; &nbsp; When i look at the raw data in&nbsp;device_last_connected_source_city&nbsp; &nbsp;, sometimes that data isn't even populated and thus arent reflected on the dashboard map , hence question as to what and when is that information populated .</P> <P>On the dashboard it seems to be some level of aggregated GPS position , though in the data from insights it only provides the "city" field , not any actual GPS .&nbsp; Also strange that its city , seems more Region , as those in Towns are aggregated to closest region City or nothing.</P> <P>Just after abit more info as to how this data is made up , so it can be determined if it can be used in threat modelling</P> Wed, 12 Jun 2024 02:31:15 GMT https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/what-populates-device-last-connected-source-city/m-p/589345#M535 M.Bathgate 2024-06-12T02:31:15Z https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/what-populates-device-last-connected-source-city/m-p/998429#M607 <P>Any one know ?</P> Mon, 16 Dec 2024 02:42:53 GMT https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/what-populates-device-last-connected-source-city/m-p/998429#M607 M.Bathgate 2024-12-16T02:42:53Z