One site a) Sophos UTM, other site b) Sophos XG - How can I get rid of the blocking

Hello Olli

If an end machine behind Sophos Firewall generates traffic on that malicious domain then an alert may be triggered by ATP. If UTM is not set as the DNS on the end machine, you might be able to see the actual source IP instead of the Public DNS (Google DNS) - as per the screenshot above

A tcpdump on port53 (DNS)  might also give insight of the actual source on the network: https://support.sophos.com/support/s/article/KB-000038909?language=en_US

Then, if you have the source end machine verified on your network you may run a full/deep-scan and set a cleanup with your AV.

Hope this helps. Have a nice day and thank you for choosing Sophos.

Cheers,

Hello Olli

If an end machine behind Sophos Firewall generates traffic on that malicious domain then an alert may be triggered by ATP. If UTM is not set as the DNS on the end machine, you might be able to see the actual source IP instead of the Public DNS (Google DNS) - as per the screenshot above

A tcpdump on port53 (DNS)  might also give insight of the actual source on the network: https://support.sophos.com/support/s/article/KB-000038909?language=en_US

Then, if you have the source end machine verified on your network you may run a full/deep-scan and set a cleanup with your AV.

Hope this helps. Have a nice day and thank you for choosing Sophos.

Cheers,

Hello Raphael, hello all,

thank you very much for you answer.

We try to find the host which is trying to connect sporadic to the IP 107.6.74.76 

Is this tcpdump command right or wrong:

tcpdump -nei any port 80,443 dst 107.6.74.76 -n -s0 -w /var/sec/chroot-httpd/var/webadmin/tcpdump.pcap


Any suggestions for a nmap, tcpdump CLI-command -or any other methods- to find a host which is trying to connect
-sporadic, that mean every 5,8,10 hours, days-
to the IP 107.6.74.76 ?
???


KR 

Olli

Hello Olli,

Good day and thanks for your response. 

Are you using UTM as DNS server for your end machine/s? If yes, you could try to use other DNS settings aside from the UTM then you should be able to see the actual source IP instead of the Public DNS (Google DNS) on the ATP section.

Cheers,