Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1786 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Advanced Threat Protection through XG proxy C2/Generic-C false positive bug?

Fred_B

When we browse to the website of https://hollandia.biz/ there is no problem. But when we go to the page https://hollandia.biz/home-services/ we get the DROP by Advance Threat Protection when the XG is used as proxy server.

There is no ATP DROP when going direct tru the XG not using the XG proxy.

Endpoint Protection X does not register any threat. 

This seems a bug in XG proxy.



This thread was automatically locked due to age.
Parents
  • 0

    the sub page is categorized as C&C

    while the base URL is general business.

    I suggest you check totalvirus for that URL and submit a URL review to Sophos Support

    as this is HTTPS traffic, the XG cannot inspect the sub-page you are visiting when you don't use the Web-Proxy. So ATP only comes when the XG can see the full URL in Proxy-mode.

Reply
  • 0

    the sub page is categorized as C&C

    while the base URL is general business.

    I suggest you check totalvirus for that URL and submit a URL review to Sophos Support

    as this is HTTPS traffic, the XG cannot inspect the sub-page you are visiting when you don't use the Web-Proxy. So ATP only comes when the XG can see the full URL in Proxy-mode.

Children
  • 0 in reply to LHerzog

    and about Intercept-X not detecting anything - I think XG and Endpoints use different sources for URL categorization. That's my personal experience when handling such stuff. So one Security-System has it listed but not the other. Strange product policy but this is how it seems to be at Sophos.