Hello,
I'm receiving intrusion prevention alerts "INDICATOR-COMPROMISE Suspicious .top dns query", in which the sources are internal IPs and the destinations are DNS or google IPs.
Could anyone please let me know why I receive these alerts and what I have to do to stop them?
Thank you in advance.
This thread was automatically locked due to age.
