Event Geolocation

Explanation

How Cloud Secure Edge records the location of user devices in event data

  • Last validated: Oct 21, 2026

Event Geolocation Overview

Event geolocation is enabled by default for every org. Whenever an end user accesses a protected resource, Cloud Secure Edge (CSE) uses the IP address of the user’s device to determine its geolocation, and records that location in Events. This gives admins visibility into where the devices in their org connect from.

The Command Center has no setting to turn event geolocation on or off. Earlier versions of the Command Center had a Use Geolocation toggle under Settings > Configuration > Advanced. That toggle has been removed.

What CSE records

In the event JSON, the client part of the User Principal records two related fields:

Field What it contains
ip_address The source IP address of the device’s connection
geo_location The location that CSE derives from that IP address, with fields such as city, region, country, continent, latitude, and longitude

For the full list of event fields, see Event Properties & Definitions.

Where the location appears

  • Events shows the full JSON of each event, including the geo_location data.
  • Logins shows each successful login on a world map and in a table, with the country that the device’s IP address resolves to.

How to interpret the location

CSE derives the location from the IP address, so the location is where the IP address is registered, not where the user is. A user on a corporate VPN, a proxy, a mobile carrier, or a satellite service such as Starlink appears in the location where that network reaches the internet. When you review event locations for an audit or an investigation, treat them as the location of the network that the device connected from.

Was this page helpful?