What to do if the EventLog Analyzer failed to update the IP's geolocation data due to network issue?
This occurs when there is no internet connection on the EventLog Analyzer server or if the creator server is unreachable.
Domains/sites to be whitelisted:
The geolocation feature is used by default for IIS Log collection and by Threat Management to download the threat feeds.
If the issue persists, check for the below traces in the server out Log file:
- "Exception while getting threat content"
- "Unable to get data from creator, response state is not 200"
Once you find the above traces, collect the logs and contact SPOC to analyze the issue further.