Threat Logs not showing specific source IP Address

VagaroITD — Wed, 06 Dec 2023 18:38:08 GMT

Hello everyone!

Just have an issue that I can't seem to figure out.

In our threat logs, we are noticing that the source address shows the default gateway address rather than a specified address. We will get a specific address, however more often then not, we see the default gateway address.

Any idea how we would be able to consistently see the specified address of where the threat is coming from rather than the default gateway?

Re: Threat Logs not showing specific source IP Address

kiwi — Thu, 07 Dec 2023 09:25:36 GMT

Hi @VagaroITD ,

Are you seeing this inconsistency for the same threat ID ?

I'd start by enabling PCAP on the threat log to get more details.

Kind regards,

-Kim.

topic Threat Logs not showing specific source IP Address in General Topics

Threat Logs not showing specific source IP Address

Re: Threat Logs not showing specific source IP Address