Forum Discussion

Copper Contributor

Jul 29, 2024

Local IPs ( 10.60.0.0/24 ) in ClientIP field in OfficeActivity logs?

Started seeing this more often recently and it started to cause some uptick in alerts across multiple customers (we are an MSP). It seems to me like a backend workflow is failing to write true source...

data collection

Log Data

microsoft defender for office 365

siem

ep3p

Copper Contributor

Aug 02, 2024

This is a bug with certain UserAgents, first it was happening with unmanaged devices, then also with managed devices. Information about the real IP address is being lost, I have opened a support case.

jmacek

Copper Contributor

Sep 23, 2024

ep3p

Has MS responded to the case?

Thanks much.