This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Receiving alerts despite being blocked by rule

I have a Creality K1 3d Printer that I prefer not phone home to China, as I would sometimes get a warning from Advanced Threat Protection that :

"The source IP/host listed below was found to communicate with a potentially malicious site outside your company".

I created a rule to drop all external packets from the device. Yet I still get Advanced Threat warnings. The Internet appears to be blocked on the printer. Should I be worried?

This thread was automatically locked due to age.

Parents

0 Raphael Alganes 9 months ago

Hello RChadwick ,

If ATP is set to 'Drop' - then events from ATP should be providing. 'logged' information which you will see on ATP dashboard and then 'dropped' as its action. https://doc.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/ATP-Global.htm

Regards,

Raphael Alganes
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Raphael Alganes 9 months ago

Hello RChadwick ,

If ATP is set to 'Drop' - then events from ATP should be providing. 'logged' information which you will see on ATP dashboard and then 'dropped' as its action. https://doc.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/ATP-Global.htm

Regards,

Raphael Alganes
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data