intrusion attack

Question

Hi all, im pretty new to the sophos firewall i noted that on the dashboard it showed an attack and also checked the logs whcih are both shown below. From this i can see that it was detected rather than blocked. Is there a way to set the IPS to block by default and if so how do i go about doing this? do is there a way of duplicating the IPS policy and changing the action to drop/block?. I am currently using the LAN to WAN IPS policy.

Edited TAGs
[edited by: Erick Jan at 4:42 AM (GMT -7) on 17 Oct 2024]

Raphael Alganes · Answer

Hello Charlie, 
 Upon further checking your output above, It seems your case might be similar to this past community thread: RE: IPS Log Messages: Anomaly - Removed the urgent flag and pointer in TCP header / Enforces IPS protection 
 Hope this helps. 
 Regards,

Raphael Alganes · Answer

Hello Charlie, 
 The firewall will detect the urgent flag and will remove (default action) the header from the packet as per the IPS settings and will allow the traffic to the source system. Once removed, the urgent flag becomes normal tcp packet, Then if packet is malicious - IPS will be dropped due to IPS policy being applied or (Depending on what IPS configuration you have) 
 So the log above states that a TCP urgent flag has been detected and thus shows a "Detect" log, and it has been removed as stated by the default settings https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/Set/index.html#ips , then passed as a normal TCP packet

Recommend you as well to cross check with ATP/Active Threat Response module if there is any malicious outbound traffic from the dest IP address and you may initiate a full endpoint scan on the dest machine as well to verify if there's any potential malicious behavior apart from the IPS detection. 
 Hope this information helps. 
 Regards,