Logsign provides you to report the geographical informations with the access logs of your clients by Geoip Lookup service. You can review the source and destination countries and cities by using this services.
You need to open this service to create a map report. You can enable it by opening the menu of Settings > Data Management > Data Management. After that you'll need to check the Geoip Lookup checkbox as you can see below.
After you checked and enabled this service, you'll be able to create a map report and view the results with it.
You need to follow the steps below to do that.
1- You'll need to have a query at first to create a report. You can visit this link to see an example for creating simple queries. Here in this example, as we'll review the access logs with the geographical informations we can select the query as below.
You can see the geographical details with the columns of Source.City, Source.Country, Destination.City and Destination.Country. After you finished to create the query, you can click on Build Report button.
2- In the window that'll open, you'll need to select the required fields as shown below.
Report Type: Must be selected as MAP.
Index Type: This field is automatically set as Log when you click on Build Report button. Here, If you want to create the report with the logs of the registered source in device list, you must set this type as Log. You can select Captive Portal to get the results of hotspot events, Alerts to get alert events, and Logsign Events to get Logsign web interface events. The column names will be changed according to the index type.
Time Column: This is already specified as Time.Generated. This is one of time attributes that log will be shown up on the Logsign interface.
Query: It will be automatically specified too, as we create the report with the query that we typed on Search bar. You can change this query here, or type it manually.
Report Name: Type the name of our report.
Rows Per Page: This is the count of logs which will be shown per page.
Filter Columns: We must select the filter columns here to summarize and look the only results that you want to see from all kind of log information.
Profiles: In this field, we can select the report profiles that we created before in Settings > Delegation > Report Profiles. By adding the profiles, the only users that have these report profiles will be able to see this report results. This is not a required field.
Category: You can select and assign this report to a category to view it quickly later by using these categories. Here you can select it as Custom/My Report.
Compliance: You can select and assign the global standarts for your report such as FISMA, ISO27001, SOX etc. This is not a required field.
3- After you completed to fill the required fields and clicked on Save button, you'll be able to view the report results as shown as below.
4- You can review the details by going over the map details. You can see the country details by different colours. Also you can customize your results by using Group Analysis button just inside the report.