Sophos Firewall

Discussions Agrab

Sophos Firewall requires membership for participation - click to join

Thread Info

State Suggested Answer
Locked Locked
Replies 4 replies
Answers 1 answer
Subscribers 28 subscribers
Views 1309 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Agrab

Paul Johnson1 over 2 years ago

Hi,

Im starting to get "SCAN Zgrab Scanning Attempt Detected" alerts, I understand who would use these, however how do I stop the alerts as they are ~+ Im sure

This thread was automatically locked due to age.

0 Vivek Jagad over 2 years ago

Hello Paul Johnson1,

Thank you for reaching out the community, are you able to see the log lines "SCAN Zgrab Scanning Attempt Detected" under the IPS logs under the log viewer ?
If so, can you confirm whether the traffic was logged and dropped OR logged and allowed ? Are you using ATP module too ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Johnson1 over 2 years ago in reply to Vivek Jagad

Hello

Thanks for your reply, the message I am getting is:

Alert ID: 7002

Message:
SCAN Zgrab Scanning Attempt Detected
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 2 years ago in reply to Paul Johnson1

can you share the log viewer > IPS logs ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlo over 2 years ago

Hi,

if you want to disable email alerts you can go to System services -> Notification list -> IPS.
Cancel
Vote Up 0 Vote Down

Cancel