connection with bad ip address

Hello Madni Malik,

Thank you for reaching out to the community, may I know what is the ATP settings configured it is just "Log traffic" OR " Log and Drop" 
And LAN to WAN scenarios if you have created a stop web/app policies then based on the bad ip reputation category blocked in web policy can prevent !! 
And by default FW will drop/reject traffic which is not allowed explicitly like for an instance WAN to LAN !! 
 

ATP settings is log and Drop. sophos also support IOC or Threat/threat Intel Feed?

ATP analyzes incoming and outgoing network traffic (for example DNS requests, HTTP requests, and IP packets) for threats. It enables you to detect compromised endpoint devices in your network and raise an alert or drop the traffic from these devices.

ATP analyzes incoming and outgoing network traffic (for example DNS requests, HTTP requests, and IP packets) for threats. It enables you to detect compromised endpoint devices in your network and raise an alert or drop the traffic from these devices.