Through Position Services feature, Logsign Unified SecOps Platform decides the position of the accessed network addresses as in or out, and shows it in the logs.
For example, type the query as "Source.Position:in Destination.Position:out" to view the accesses from inside network to outside. Logsign Unified SecOps Platform looks at the position services list for the existing network addresses, and then generates the report by using these information.
Network lists are come by default on Logsign Unified SecOps Platform. If you have several private networks, we recommend you to add them to Position Services for generating better reports with the help of position columns.
Follow these steps to add your private networks:
1- Click Settings -> Enrichment -> Position Services.
2- You can see the default network addresses with their subnets. You can add your private network addresses or remove the existing ones in this section.
3- Click + Position Services button to add a new network. Insert the network address and subnet mask.
4- Click Delete button to remove an existing network from your list.
NOTE: IP addresses which belong to these networks will be positioned as in, and other IP addresses will be positioned as out.