An attempt to communicate with a botnet or command and control server has been detected.

Hi Chris Anthony1: If any end machine behind XG generates traffic on that malicious domain then an alert may be triggered by ATP. If XG is not set as in DNS on the end machine in that case you may be able to see the source as in those DNS IPs in place of the actual source IP. Here ATP action is "Log & Drop" so no IP-based rule is required to drop it. Also Capturing TCPDUMP on the DNS port may give the actual source if the DNS request is routing via XG. Once you get the source machine you may scan it with antivirus software or may remove unwanted apps or may re-install the OS with only necessary software etc.

Hi Chris Anthony1: If any end machine behind XG generates traffic on that malicious domain then an alert may be triggered by ATP. If XG is not set as in DNS on the end machine in that case you may be able to see the source as in those DNS IPs in place of the actual source IP. Here ATP action is "Log & Drop" so no IP-based rule is required to drop it. Also Capturing TCPDUMP on the DNS port may give the actual source if the DNS request is routing via XG. Once you get the source machine you may scan it with antivirus software or may remove unwanted apps or may re-install the OS with only necessary software etc.