Does anyone know of a quick action for geolocation?
I have not needed one yet as it is already in our logs but you could:
1/ Use a website’s API with the HTTP module (some sites may offer free APIs) - less than 10 min setup
2/ Check in the logs using the relevant module (IDR if you are a customer or any other integration with your SIEM) to get that from your logs (a lot of providers like MS, etc. already provide that geolocation in standard login logs)
Thanks for the feedback, i’ll give it a shot
The different WHOIS actions should give some geolocation info.
