You can also include a geographic map of logins or devices where it displays the last known location. The following image shows the geographic map option on the Devices page.
To get the geographic map option, you must configure the “Enable Device Location Tracking by Administrator” option in Policies > Mobile Device Policies > Common Mobile Settings > Restriction Settings. See How to configure device location reporting and tracking.
Location data for a device is encrypted, but you can extrapolate it from the IP address. Keep in mind, however, that location data is accurate to within about 50 miles—the locations are not precise.
Use the IpLookup() function to convert IP address data to geographical data, with the following syntax:
For example, the following report query returns the locations of failed logins within the last 30 days.
select iplookup(FromIPAddress,'longitude') as Longitude, iplookup(FromIPAddress,'latitude') as Latitude, FailUserName || ' - ' || formatdate(whenoccurred , 'G') as Name from event where eventtype='Cloud.Core.LoginFail' and whenoccurred > datefunc('now', -30) limit 1000
For a report to display results in a geographical map, you must select the option “Report can be displayed on a map” and include the following column labels in your report query:
- Name (this is any string value; it’s used to label a location on the map)
Note: Map view is not available in reports preview mode. Country names and city names are in English.