Have about 100 Sophos SG's deployed. Several of them automatically updated to pattern version # 198832 today. Starting at roughly 3PM Central Time 5/6/2021 today we started receiving advanced threat detection alerts. The IP being flagged is 104.18.20.226. Oddly, alienvault shows the most recent DNS name associated with that IP is " sophos.naumann-systemhaus.de "
anyone else seeing this? is this just a bad pattern push?
This thread was automatically locked due to age.
