This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intrusion Protection Alert (Email) Change in ASG 8.2

Hello,

I recently upgraded my ASG box to ASG 8.2.  I am continually getting email about Intrusion Prevention Alerts of varying priority.  On the previous version, I wasn't getting these and haven't changed my notifications.  Below is an example.  Did something change in ASG 8.2?

Intrusion Prevention Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: WEB-CLIENT HTML DOM invalid DHTML comment creation attempt
Details........: Snort ::
Time...........: 2011:08:23-10:24:25
Packet dropped.: yes
Priority.......: high
Classification.: Attempted User Privilege Gain IP protocol....: 6 (TCP)

Source IP address: 98.129.63.179
Where are my results?
Database Query
http://ws.arin.net/cgi-bin/whois.pl?queryinput=98.129.63.179
APNIC - Query the APNIC Whois Database
Source port: 80 (http)
Destination IP address: 192.X.X.X
Where are my results?
Database Query
http://ws.arin.net/cgi-bin/whois.pl?queryinput=192.X.X.X
APNIC - Query the APNIC Whois Database
Destination port: 58418
        
-- 
System Uptime      : 3 days 8 hours 0 minutes
System Load        : 0.22
System Version     : Astaro Security Gateway 8.201

Please refer to the manual for detailed instructions.


This thread was automatically locked due to age.
Parents
  • Mehrzad, I think Wingman was looking for the bottom of that screen - the part with 'Attacks on Client Software'.  Also, check your POP3 server to see if there are a lot of failed logon attempts and where they come from.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • You should probably also check the Advanced Tab under Intrusion Prevention, and make sure the rule in question is not manually set to Alert only.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Reply
  • You should probably also check the Advanced Tab under Intrusion Prevention, and make sure the rule in question is not manually set to Alert only.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Children
No Data