Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Why is Geographical Location of IP Addresses not correct?

Carbon Black Cloud: Why is Geographical Location of IP Addresses not correct?

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Sensor: All Versions
  • Microsoft Windows: All Supported Versions
  • Apple macOS: All Supported Versions

Question

Why are the Geographical IP (GeoIP) locations shown in some Events incorrect when reviewing the IP Address data via external GeoIP sources?

Answer

  • The Carbon Black Cloud leverages a third-party service for GeoIP look-ups. GeoIP services are able to resolve to the right city or location most of the time, but GeoIP look-ups are never completely accurate. In some cases the location shown for an Event will be significantly different from what can be found checking GeoIP Location services directly.
  • An internal ticket, DSER-16078, has been created to migrate to an improved version of the database from the vendor. This article will be updated once a release date is known.

 

Additional Notes

We are unable to share which third-party service is being used, as the provider may be changed to address any issues.
We continue to work with our GeoIP provider to show as accurate information as possible. Unfortunately, there will always be cases where the GeoIP data is inaccurate due to the innate nature of GeoIP which is especially true in relation to the newer IPv6 protocol.

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
359
Contributors