IPS alerts - SID 57103 - SophosUpdate.exe process

RE: IPS alerts - SID 57103 - SophosUpdate.exe process

Fabio Canabarro — Wed, 29 Dec 2021 15:11:04 GMT

Hello,

After enabling update via HTTPS the alerts stopped, thanks!

RE: IPS alerts - SID 57103 - SophosUpdate.exe process

Fabio Canabarro — Tue, 21 Dec 2021 14:38:25 GMT

Hi, thanks for the reply!

I'm testing the update change to HTTPS on these customers, but in parallel I'll trigger Sophos support as suggested. Having an answer from them I share with you.

Thanks again

RE: IPS alerts - SID 57103 - SophosUpdate.exe process

Fabio Canabarro — Tue, 21 Dec 2021 14:31:40 GMT

I found in Sophos Central where to change the update option to HTTPS, in fact in this client it was set to HTTP. I changed it to HTTPS and I will monitor if IPS alerts stop.

Before:

After:

I will monitor and report the result.

Thanks!

RE: IPS alerts - SID 57103 - SophosUpdate.exe process

Fabio Canabarro — Tue, 21 Dec 2021 14:14:48 GMT

Hello, thanks for the reply!

I checked the file you indicated, precisely in the UTM where I have these IPS alerts the UseHttps parameter is set to zero:

UseHttps=0

In other environments (completely separate Sophos Central and UTM customer) this option is set to 1.

Do you know if this option is adjustable from Sophos Central? In the iconn.cfg file there is an indication not to edit it directly, I don't know if doing this will impact the endpoints.

RE: IPS alerts - SID 57103 - SophosUpdate.exe process

Sophos User930 — Mon, 20 Dec 2021 20:42:47 GMT

Out of interest, if you open:

C:\ProgramData\Sophos\AutoUpdate\Config\iconn.cfg

What is UseHttps set to?

RE: IPS alerts - SID 57103 - SophosUpdate.exe process

BAlfson — Mon, 20 Dec 2021 14:25:27 GMT

Olá Fabio and welcome to the UTM Community!

Excellent and thorough explanation of the situation. I think this needs to have someone look at it - probably a 2nd- or 3rd-level engineer at Sophos Support as it involves both UTM and Intercept X. Please share with us what they conclude.

Cheers - Bob