Thread Info
  • Locked Locked
  • Replies 7 replies
  • Subscribers 5 subscribers
  • Views 4589 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ATP False alerts about C&C pointed to internal DNS

krzysztof turkiewicz

Hello,

my UTM ATP shows me alerts about host trying connect to C&C. The problem is that ATP shows that it is my internal DNS server (which is for 100% clear -  fresh installation) , so i am not able to recognize which host in fact is asking my DNS server about that malicious site. In Barracuda they have software installed directly on internal dns and communicate with Firewall, so there is full info about what IP is in fact asking about it. Maybe You shoud try to make similar soft to sophos.



This thread was automatically locked due to age.
Parents

  • Hi, Krzysztof, and welcome to the UTM Community!

    Since you didn't show us the alert message, I'll guess that some PC in your organization requested name resolution from your server and that your server then requested name resolution through the UTM.  The UTM can't see that the original request came from another device in your organization.

    Cheers - Bob

  • in reply to BAlfson

    Yes, you are right, this is the situation - one of my host ask my internal dns about suspicious address and than dns is asking through my UTM. ( that is why UTM has no idea about client).  This is very common situation in every company. My post was only suggestion for you to consider to write special software installed on DNS (windows AD). This software communicate with UTM and give it all info about clients dns queries. Its simple program but can change a lot because UTM would then inform me who is REALLY asking dns about suspicoius website. 

  • in reply to krzysztof turkiewicz

    Dear Krzysztof,

     

    nice feature request (try to post it here http://ideas.sophos.com/forums/17359-utm-formerly-asg-feature-requests ). As a kind of 'workaround' use the UTM as first DNS for your internal clients. Then you'll get the correct IP in first attempt without looking at the internal AD-DNS. This works very well.

     

    Best regards,

    Alex

Reply Children