This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

First ATP Reported

I noticed yesterday that our firewall had reported this anomaly coming from our mail server. The destination IP is simply an open DNS I added to the DNS setting on the device but this also occurs on the other entries as well, why would it report this?

This thread was automatically locked due to age.

Parents

0 Femi Dada over 7 years ago

Seeing the same on my newly deployed SG reporting the host was an all in one (exchange server)

Any idea?
Cancel
Vote Up 0 Vote Down

Cancel
0 Sean Hunter over 7 years ago in reply to Femi Dada

Looks to me like a false positive. Anyone know what threat feed the XG use? If we can track down the source maybe we can fix (or confirm, or limit the scope of) the issue/impact.

I don't mind an email from my appliance with a false positive, but I'd like to be able to tune it so I don't keep getting the same false positives after investigation.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sean Hunter over 7 years ago in reply to Sean Hunter

FYI for those following the thread: This should be resolved now. You should probably contact Sophos if you're still experiencing this error for this specific URL.
Cancel
Vote Up 0 Vote Down

Cancel
0 SophosNewby over 7 years ago in reply to Sean Hunter

When was it resolved? Last log was 12-28-2017 @ 3.10PM EST.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sean Hunter over 7 years ago in reply to SophosNewby

Sometime this morning. Keep an eye out for new alerts but you shouldn't see any more.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Sean Hunter over 7 years ago in reply to SophosNewby

Sometime this morning. Keep an eye out for new alerts but you shouldn't see any more.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data