Through Location Services feature, Logsign Unified SecOps Platform can decide the location of the accessed network addresses, and shows it in the logs.
For example, type the query as "Source.Location:LondonOffice" to view the accesses from London. Logsign Unified SecOps Platform looks at the location services list for the existing network addresses, and then generates the report by using this information. The same lookup is done for the destination address, so "Destination.Location:LondonOffice" works as well.
Follow these steps to add your private networks:
1- Click Settings -> Enrichment -> Location Services.
2- Click + Location Service to add a new network. In the Add Location Service window, enter the Location Name, type a network in the Subnets field in address/netmask format (for example 192.168.1.0/255.255.255.0) and click Add. Repeat this for every network that belongs to the same location, then click Save. Each location name can be used only once.
3- Click Delete button next to a location and confirm to remove it from your list. To change the name or networks of an existing location, use the Edit button on the same row.
You can filter the list by location name or network with the Search box above the table, sort it by location name, and export it with Download csv file.
Additionally, if there is a scenario related to a specific position, it is recommended to use the bucket structure (Settings -> Alerts and Incidents -> Buckets).