This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Agrab

Hi,

Im starting to get "SCAN Zgrab Scanning Attempt Detected" alerts, I understand who would use these, however how do I stop the alerts as they are ~+ Im sure

This thread was automatically locked due to age.

0 Vivek Jagad over 1 year ago

Hello Paul Johnson1,

Thank you for reaching out the community, are you able to see the log lines "SCAN Zgrab Scanning Attempt Detected" under the IPS logs under the log viewer ?
If so, can you confirm whether the traffic was logged and dropped OR logged and allowed ? Are you using ATP module too ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Johnson1 over 1 year ago in reply to Vivek Jagad

Hello

Thanks for your reply, the message I am getting is:

Alert ID: 7002

Message:
SCAN Zgrab Scanning Attempt Detected
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Paul Johnson1

can you share the log viewer > IPS logs ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlo over 1 year ago

Hi,

if you want to disable email alerts you can go to System services -> Notification list -> IPS.
Cancel
Vote Up 0 Vote Down

Cancel