X-Ops seems not to be working on V21 GA?

Question

Hi, 
 I moved to Version 21.0 GA (Home Edition) recently. 
 I noticed that in control panel, no events in the log or counters are logged that X-Ops is doing anything: 
 A configured third party threat list (abuseipdb.com) is working properly and blocks and reports in the logs. 
 X-Ops (formerly ATP) was enabled the whole time, even before upgrading from 20.0 MR2 to 21.0 GA, and my Home License includes it. Signatures are also updated regularily.

Wayne Folta · Answer

My thought would be that X-Ops is looking for much more severe threats than most third-party (crowd-sources) lists. Also X-OPS is not blocking probes to your VPN (if you're running that service on the WAN) because there are so many sites probing various ports which you can see in Appliance Access rejection most of the time. (And these sites are constantly changing.) But if you happen to be running VPN on the WAN and your third-party happens to have an IP of a site that happens to be probing VPN ports, you'll see blocks that didn't appear before. 
 (In other words, third-party lists will have more false positives and can have a very broad definition of what should be blocked. For example, one person discovers one malware file on a site and they can submit it to a crowd-sourced site and if you're using that list you may see blocks that have nothing to do with that file. And a third-party block list blocks things like VPN access that would otherwise be blocked by the VPN credentials failure.) 
 As a concrete example, the FireHOL L3 IP list includes an IP for githubusercontent. Sure enough, some folks may have malware there, but to block it completely is extremely broad! It's triggering on my system because I have an open source program that gets its updates that way. It's sort of like blocking all Gmail because you got spam from an Gmail address. FireHOL is a reputable source, but free third-party sources will suffer from this kind of thing.

X-Ops seems not to be working on V21 GA?

Top Replies