In the Log Activity page, when we do "Add filter", we are asked to choose the Parameter, Operator and Value.

Parameter: Direction

Operator: Equal

Value: R2L

The above filter should display the traffic from the remote to the Local IP. Here Local IP is the IP address which we mentioned in the Network Heirachy.

Sometimes, the source IP and destination IP will be the same in the data. But it shows the result using the above filter. This article explains the RCA and how to fix the issue

Firstly, please check the payload of the event which is having the issue:

<13>Nov 12 13:34:49 abc AgentDevice=WindowsLog AgentLogFile=Security PluginVersion=7.3.1.28 Source=Microsoft-Windows-Security-Auditing Computer=ComupterName.DC OriginatingComputer=x.x.x.x User= Domain= EventID=4648 EventIDCode=4648 EventType=8 EventCategory=12544 RecordNumber=79988906 TimeGenerated=1731411287 TimeWritten=1731411287 Level=Log Always Keywords=Audit Success Task=SE_ADT_LOGON_LOGON Opcode=Info Message=A logon was attempted using explicit credentials. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x9711 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: [email protected] Account Domain:  Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: ComuterName.DC Additional Information: CQExchVD04.CDCQPN.DC Process Information: Process ID: 0x205c Process Name: C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe Network Information: Network Address: yyyy::yyyy:yyyy:yyyy:yyyy Port: 443 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

Here, the traffic is actually from the remote source with the IP address  yyyy::yyyy:yyyy:yyyy:yyyy to the IP x.x.x.x. But it displays source and destination as the same IP. Because it is IPv6. Not IPv4.

Reason:

Because IPv6 Source Address and IPv6 Destination Address are not default columns, they are not automatically displayed. To display these columns, you must select them when you configure your search parameters (column definition).

To display IPv6 address, please click on Search > Edit Search and add the columns "Source IPv6" and "Destination IPv6" and perform a search

If the customer doesn't want to see this event in R2L filter, please add the IPv6 address yyyy::yyyy:yyyy:yyyy:yyyy in the Network heirachy with CIDR.