application filter events

Hello Jakub Kavka,

Thank you for reaching out to the community, GaduGadu is an instant Messenger application which falls under the instant messenger category and it's risk level is 4:
KBA - Sophos Firewall: How to prioritize the traffic via SD-WAN for the applications

So, unde the rule no 40, if you have applied the following application filter applied:

And you have the logged firewall rule option ticked and under the system services > log settings > content filtering > application filter options enabled:

then you'll see the events generated under the log viewer and the action is denied. So this is genuine and fine if you want the application to be blocked in your organization !! 

Hello Jakub Kavka,

Thank you for reaching out to the community, GaduGadu is an instant Messenger application which falls under the instant messenger category and it's risk level is 4:
KBA - Sophos Firewall: How to prioritize the traffic via SD-WAN for the applications

So, unde the rule no 40, if you have applied the following application filter applied:

And you have the logged firewall rule option ticked and under the system services > log settings > content filtering > application filter options enabled:

then you'll see the events generated under the log viewer and the action is denied. So this is genuine and fine if you want the application to be blocked in your organization !! 

Hello,

yes thats how we have this configured. But i am asking more like about characteristic of this specific event because nobody in our org definitly not using GaduGadu messenger so i am wondering what is going on.

characteristics of the application is widely used like to transfer files and also to tunnel other apps !!

I ended up blocking access to it, it seems to be if you open a web site with that application even on the page it makes contact.

Ian

blocking attitude feels like healing a symptom not the core problem which is causing it. I'm going to raise a support case at Sophos and our local Sophos partner and we will see

If you do some further analysis of the traffic you will find that it is not false positives but actual attempts to connect to the gagugagu servers, that is why I blocked it.

Ian