How is the location of a sensor/endpoint determined?

Hi there,
It’s possible that the location you're seeing is being influenced by a VPN or proxy service the end-user might be using. Sophos typically calculates the location of a device based on the IP address it detects, which can sometimes be routed through different countries when VPNs or certain network setups are in use. Alternatively, it could also be due to an issue in the location data provided by the network. To clarify this, you might want to check if the endpoint is behind a VPN or reach out to the user for more details on their network configuration. If neither applies, there could be a rare bug, and contacting Sophos support for further investigation would be helpful.

Understood. I wondered if it was just a bug as the new(?) custom dashboard is often 'unavailable', presumably as they've found another bug. The affected device we knew to be in the country and in fact on site, but had there were detections that suggested it was elsewhere in impossible timeframes. I'm content with the answer provided by fsvq for now and wil lwork through the detections to take appropriate action.

Understood. I wondered if it was just a bug as the new(?) custom dashboard is often 'unavailable', presumably as they've found another bug. The affected device we knew to be in the country and in fact on site, but had there were detections that suggested it was elsewhere in impossible timeframes. I'm content with the answer provided by fsvq for now and wil lwork through the detections to take appropriate action.