ATP Exceptions is not working

Hi,

if it is a real site then you need to change the log and drop setting.

Ian

I don't understand ?
I want the keep the log and drop settings, I don't want to Log only.

Hi,

wrong suggestion, try again. Appears as though one of your users is causing the issue with the site, check the log viewer to see if you can identify the source.

Ian

edited - I hate spellchecker.

Yes, I can identify the source.
One CentOS VM that use this site for repos
And our DC who try to resolve this FQDN

Hi Alexandre,

Have you checked if IPS or Web Filtering is blocking the said URL? centos.brontocdn.com

Cheers,

Hi,

This is the type of message that we receive

So I believe that it's triggering ATP, only ?

Regards

Hello,

Other security features of SF might be also triggering the block/deny on the said URL such as IPS and Web filter. Kindly see logs of those modules and check if there's any hit on deny for this specific website.

Thanks!

Cheers,

For Intrusion Attack nothing ..

IPS

And Web Filter

Hello, 

Thanks for sharing this, On your Web Filter logs you may try to adjust time filter to Last10mins up to 4hours or on the search button on upper right you can directly type in centos.brontocdn.com and make sure logging is on in the firewall rule

I tested the link on my SF and it has been detected as Spyware and therefore blocked as per my Web Filter Rules: 

It seems the said link is a CDN link for CentOS. Could you clarify if this is detection is same on your end? and If your Web Filter rules also blocks this specific category? Also can you confirm what SFOS version you are running?

If you have tried testing this via Policy Tester which is under Log Viewer > Policy Test and produced the same result and believe that this is a legitimate website:

You may create an exception for this: docs.sophos.com/.../index.html

And also file this to SophosLabs for submission: support.sophos.com/.../filesubmission

Hope this helps. Thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hello

Thanks for the info 

This is all records and the URL

So I'm using SFOS 19.5 GA

I tried with Policy Test

That's weird 

And I tried this too

But still the same ATP error throwing

Regards

Alexandre