Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 10 replies
  • Subscribers 0 subscribers
  • Views 2984 views
  • Users 0 members are here
Options
Suggested

[9.165][BUG] ATP Warning

MarkMurphy
How is this possible? this is an outside address that the firewall is reporting as internal and blocked? I use NAT and 192.168.1.0 subnet ID internal

Details about the alert:
Threat name....: C2/Generic-A
Details........: C2/Generic-A - Viruses and Spyware - Threat Analysis - Threat Center - Antivirus, Endpoint, UTM, Mobile, Email, Server, Disk Encryption, and Web Security | Sophos
Time...........: 2013-11-11 03:52:34
Traffic blocked: yes
Internal source IP address or host: 88.81.102.210
Parents
  • 0
    Hi,

    The threat probably comes from IPS. If you check the snort mappings in /etc/snort/snortc2_mapping.ph there are also threats with C2/Generic-A. In next release 9.170, in case of atp events from snort, the SID will be  appended to the threat name in the notification email.

    The key word "Internal" is definitely wrong since the threat comes from an external source. Will open a ticket for that.

    Thanks,
    Bianca
Reply
  • 0
    Hi,

    The threat probably comes from IPS. If you check the snort mappings in /etc/snort/snortc2_mapping.ph there are also threats with C2/Generic-A. In next release 9.170, in case of atp events from snort, the SID will be  appended to the threat name in the notification email.

    The key word "Internal" is definitely wrong since the threat comes from an external source. Will open a ticket for that.

    Thanks,
    Bianca
Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?