Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 17 replies
  • Subscribers 32 subscribers
  • Views 24933 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

First ATP Reported

SophosNewby

I noticed yesterday that our firewall had reported this anomaly coming from our mail server. The destination IP is simply an open DNS I added to the DNS setting on the device but this also occurs on the other entries as well, why would it report this?

 



This thread was automatically locked due to age.
  • 0 in reply to axsom1

    John, You have to be able to determine what domain lookup is be requested by your client(s). Once you know the domain then you can lookup to up using IPVoid, VirusTotal, etc to see the severity of what is malicious. The rule(s) on the XG that fire based on DNS traffic like this are to let you know that something on your network (in this case since it is your DNS Server) is requesting a domain that matches this signature.

    There is just not enough logging detail in the XG (not its fault) when this fires and you have to look at the DNS server itself to determine what client(s) and what domain(s) are causing this rule to trigger.

    Hope this helps. Merry Christmas & Happy New year.

    -Ron

  • 0 in reply to rrosson

    Thanks Ron.   Appreciate the insight.

    The URL in the ATP reports is .

    This is what is coming back clean via some online lookups, so unsure if the clean reports are legit or the ATP reports.  I think it was something bad in the signature, but no proof as of yet.

    Merry Christmas and Happy New Year to you as well.

    Cheers,

    John

  • 0

    Seeing the same on my newly deployed SG reporting the host was an all in one (exchange server)

    Any idea?

  • 0 in reply to Femi Dada

    Looks to me like a false positive. Anyone know what threat feed the XG use? If we can track down the source maybe we can fix (or confirm, or limit the scope of) the issue/impact.

    I don't mind an email from my appliance with a false positive, but I'd like to be able to tune it so I don't keep getting the same false positives after investigation.

  • 0 in reply to Sean Hunter

    FYI for those following the thread: This should be resolved now. You should probably contact Sophos if you're still experiencing this error for this specific URL.

  • 0 in reply to Sean Hunter

    When was it resolved? Last log was 12-28-2017 @ 3.10PM EST.

  • 0 in reply to SophosNewby

    Sometime this morning. Keep an eye out for new alerts but you shouldn't see any more.