Threat Logs not showing specific source IP Address

[VagaroITD]

Hello everyone!

Just have an issue that I can't seem to figure out.

In our threat logs, we are noticing that the source address shows the default gateway address rather than a specified address. We will get a specific address, however more often then not, we see the default gateway address.

Any idea how we would be able to consistently see the specified address of where the threat is coming from rather than the default gateway?

[kiwi]

Hi @VagaroITD ,

Are you seeing this inconsistency for the same threat ID ?

I'd start by enabling PCAP on the threat log to get more details.

Kind regards,

-Kim.