This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Massive ATP Alerts? AFCD/iptables IP 93.184.221.240

Almost all of our customer UTMs did generate an ATP alert for IP Address 93.184.221.240. It starts around 16:00 (I received ~7 alert mails per UTM)

Was there a pattern update? False positive? Any Infos about that?

regards

This thread was automatically locked due to age.

Parents

+2 Aditya Patel over 5 years ago

Hello Everyone,

We have checked from our end and have determined that it is a false positive. We are working on this issue and should be fixed with the next available pattern update.

Ref: NUTM:10832

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
+4 FloSupport over 5 years ago in reply to Aditya Patel

Hi All,

Sophos has updated the pattern version and the IP should no longer be blocked. Customers are requested to perform a manual pattern update to verify this.

More info available in the published advisory article.

Regards,

Florentino
Director, Global Community & Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the 'Verify Answer' button.

The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Louis-M over 5 years ago in reply to FloSupport

This had me checking for a while. Appreciate the fast response and appreciate the users of the forum coming on here straight away to report.

Many thanks to the OP for the clear thread title too
Cancel
Vote Up 0 Vote Down

Cancel
0 isoffice over 5 years ago in reply to FloSupport

Hi FloSupport,

Thank you for the update and link to the relevant advisory article.

We also experienced this issue for approximately 2 hours on 4th April 2019 (3.15pm - 5.25pm GMT).

Good work on a prompt resolution.

Best regards,

John P

2 x SG450 (Version 9.714-4)

HA = Active-Passive
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 isoffice over 5 years ago in reply to FloSupport

Hi FloSupport,

Thank you for the update and link to the relevant advisory article.

We also experienced this issue for approximately 2 hours on 4th April 2019 (3.15pm - 5.25pm GMT).

Good work on a prompt resolution.

Best regards,

John P

2 x SG450 (Version 9.714-4)

HA = Active-Passive
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data