Global Security Forum

Security Global Forum

Our mission is to provide clients with an online user community of industry peers and IBM experts, to exchange tips and tricks, best practices, and product knowledge. We hope the information you find here helps you maximize the value of your IBM Security solutions.

 View Only

  • 1.  Weird Source IP In Offense

    Posted Wed December 28, 2022 03:36 AM
    Hi,
    Sometimes the proper source IP is not captured in an offense.  I could not find the same IP in the events.


    Why are we receiving offense for this source IP?
    How can we tune this?


    Thanks

    ------------------------------
    Arunkumar R
    ------------------------------


  • 2.  RE: Weird Source IP In Offense

    Posted Tue January 03, 2023 12:11 PM
    ::1 is one of the loopback addresses for IP V6.  You can set QRadar to prioritize IP v4 in the nva.conf.  But it will always accept IP V6 addresses.

    ------------------------------
    Frank Eargle
    ------------------------------

    Original Message


  • 3.  RE: Weird Source IP In Offense

    Posted Thu January 05, 2023 06:10 AM
    Hi Frank,
    Thank you. I have changed the configuration as you suggested.



    ------------------------------
    Arunkumar R
    ------------------------------

    Original Message


Related Content