Logs for Geo Updatable Object Source country

[Don_Paterson]

Is there are way to search for Source country in the logs?

The SK says that logs are not indexed.

https://support.checkpoint.com/results/sk/sk144192

Field Name	Field Display Name	Type	Description	Indexed	Added in Version
Common Fields

src_country	Source Country	string	Country name, derived from connection source IP address	No	

[simonemantovani]

For what I know, you can't specify source or destination country for the filter, but if you enter the name of the country like "united states" all the logs related to United States (source or destination) are displayed.

In addition, you could try a filter like <country_name> AND <rule_uid> if the traffic you're looking for should be matched by specific rule.

[Bob_Zimmerman]

IP blocks get moved all the time (thus the need for updatable objects). Any idea if this information is recorded in the log entry (like source and destination IP) or if it's resolved when you look at the log (like source and destination object names, service name, etc.)?

[PhoneBoy]

Pretty sure the lookup occurs in realtime (i.e. it's not stored).