Traffic originates from an unknown location

In the QRadar® Network Threat Analytics map view, network traffic is shown to originate from an Unknown location.

Network traffic that does not fit within the defined network hierarchy in IBM® QRadar is grouped and shown to originate from a common, but unknown, location. Traffic that has an IP address that does not have a known geolocation is also shown to originate from the unknown location.

To resolve this problem, ensure that the QRadar network hierarchy is accurately defined. For best results, include the Country/Region, Latitude, and Longitude values when you define the network segment.

For more information about defining your network hierarchy, see Network hierarchy in the IBM QRadar Administration Guide.