Using the geolocation plug in. I have also added the Sonicwall Content pack. If I look at messages received I see can dst_ip_geolocation and src_ip_geolocation and if I do a search with just the the source import
I can see the geolocation fields, but if I add to the search
gl2_source_input:“595e3aaf83224e0e1b25d857” AND (msg:“XAUTH Succeeded with VPN client” OR m:139) then the geolocation fields are no longer showing. Any help would be much appreciated.