topic Re: Threat Logs: Countries with no IP in General Topics

Threat Logs: Countries with no IP

raji_toor — Fri, 31 Mar 2023 15:43:36 GMT

So we have 'Use X-Forwarded-For HeaderEnabled for Security Policy' enabled, and are using it policies.

The threat logs show the real Source Country but no address under X-Forwarded For IP Column. Although when exported to CSV many logs show the real address under XFF column. And many don't. Again checking in GUI although some logs show XFF in in packet capture(single packet enabled) it does not show in the logs.

Now because I cannot filter for XFF in threat logs, I can't use dynamic address groups to auto block these IPs

Logging need to be improved for 'Use X-Forwarded-For HeaderEnabled for Security Policy' feature.

We are on 10.1.8

Re: Threat Logs: Countries with no IP

SutareMayur — Mon, 03 Apr 2023 15:04:34 GMT

Hi @raji_toor ,

Please check if this -

Click here for more details.

Re: Threat Logs: Countries with no IP

raji_toor — Thu, 20 Apr 2023 14:55:13 GMT

Thanks @SutareMayur , Yes that was an oversight. Low level logs without packet capture were showing as expected and critical also stated showing IP address after disabling packet capture on vulnerability profile.