Geo Lookup Not Evaluating with Trace

[joelbland]

Hello,

I'm attempting to validate an incoming content filter using the Trace function before committing the changes to the ESA, however, it appears that it doesn't actually evaluate the country code from the IP address given. However, if I commit the change and review the mail_logs, the ESA matches on the country code.

Example filter:

Trace Information:

IP Address = 178.250.144.155

Senderbase indicates this IP is located in the Netherlands.

(https://talosintelligence.com/reputation_center/lookup?search=178.250.144.155)

However, the Trace results do not reflect that:

While the mail_logs do correctly reflect this, only when the content filter has been committed:

Info: MID123456 Custom Log Entry: Detect-NL-LogEntry detected connection from the Netherlands on IP 178.250.144.155

Should the ESA evaluate the country code in the Trace function?

Thanks!

[Mathew Huynh · Accepted solution]

Hello Joelbland,

I don't believe the trace tool currently includes geo-location lookup.
An Enhancement request may be required to be filed for the functionality to be considered.

Regards,
Matthew

[joelbland]

Thanks, Mathew. I'll submit a feature request to TAC.