Summary
The Security Management System (SMS) incorporates a feature called Geo Locator. The GEO Locator database contains geographical information associated with IP addresses. You can enable the Geo Locator Lookup service to correlate the country of origin for host IP addresses associated with events. You can also query the database to view the country location of a specified host name or IP address. In addition, with the Geo Locator service enabled, you can also view a map showing the country of origin for all IP addresses generating events.
Details
The GEO Locator database comes from a third party company called MaxMind which specializes in geo-location. The company builds global IP address location database by overlaying geographic user data on to a map of the internet's infrastructure. Trend Micro TippingPoint is providing (via the TMC https://tmc.tippingpoint.com) a GEO Locator database in the familiar .pkg file format. This version of the GEO locator database is updated on a monthly basis.
Note: The SMS does not automatically download or install the GEO Locator databases; the user must download and install them manually. The GEO locator database is only available via the SMS.
Procedure
- Login to the TMC and download the most current GEO Locator database file from RReleases->Software->SMS->GEO Location to the local PC.
- Log in to the SMS from a client.
- On the SMS toolbar, navigate to the Admin->Geo Locator Database tab.
- Within the Geo Locator Database area of the Geo Locator Database screen, click the Import button. A standard Windows explorer dialog will open.
- Locate the database file just downloaded and click OK to Import.
- Once the database has been uploaded, you will see the following information;
