Active Threat Response

Hello,

Yesterday, I got the ATR dropping a request made to a potential threat. The thing is, that the source threat was our DNS/DHCP server, and the threat destination is "stylesheet.webstaticcdn.com" with no ip or trace.

I've starte a full scan, everything seems fine.

Is there any thing could I do to know what exactly happened?

this issue occured 9 times in the same day.

Regards,

Thank you.

Parents

0 LuCar Toni 5 hours ago

This is an old "issue" of ATR. As you DNS is your server, some of your clients asked the DNS to resolve this. SFOS only see the DNS request from the DNS server.

Do you use Sophos Endpoint XDR?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Maroun Moussallem 2 hours ago in reply to LuCar Toni

unfortunately not, we have the intercept X.

but why? could I investigate more on the problem with the XDR?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Maroun Moussallem 2 hours ago in reply to LuCar Toni

unfortunately not, we have the intercept X.

but why? could I investigate more on the problem with the XDR?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data