@Akshay04 thanks for reporting. Please open a customer support case, so that we can investigate and, if appropriate, correct our records moving forward.

Hi @Akshay04

Chronicle uses a range of different methods to identify the geolocation of an Ip Address, "Google proprietary IP geolocation technology uses a combination of networking data and other inputs and methods to provide IP address location and network resolution for our users. Other organizations may use different signals or methods, which might occasionally lead to different results."[1].

The inconsistency between what Virustotal outputs, and what is ingested within your SIEM, is likely that the country and geolocation outputted in Virustotal is old (by the looks of the screenshot, 1 year ago). In extreme circumstances where the geolocation enrichment is inaccurate, you can open a support ticket where this can be investigated. Other tools use different methods or apis to perform geolocation enrichment, all of which don't have 100% accuracy.

[1] -