Application and Threat Summary report

[OmarKhan]

Hello,

i am confused a little bit when i found out that 10.0.0.0-10.255.255.255 is listed in Top 5 Destination country. What actually refers 10.0.0.0-10.255.255.255 in this instance?

Regards,

[kadak]

Hello OmarKhan,

I believe you trying to figure out the top 5 attackers (in terms of countries) in your threat summary report. If that is the case, we should look at the Top5 source country column. In threat logs as compared to traffic logs, the source (attacker) and destination (victim) definitions are flipped. In your case, 10.0.0.0-10.255.255.255 are IP addresses in your LAN network - 10.0.0.0/8 which are referred as victims.

For example:

Traffic log:

Threat log:

In the above example, 192.168.0.0-192.168.255.255 are being attacked by an IP address from US : 173.199.132.56

Hope that helps!

Thanks and regards,

Kunal Adak