Hi,
I was wondering if anyone else has experienced a ramp up in the last few days on UTM9 appliances with the IPS module.
As of a few days now, my IPS attack detections have gone up ten-fold.
I spotted a particular signature triggering these detections;
| 44077 | INDICATOR-COMPROMISE Suspicious .win dns query |
After investigating the sources causing the triggers to go off (DC/DNS servers), all seems normal and nothing was changed on them to warrant such activity.
Were there some changes made to the IPS signatures recently that could be causing this?
Thank you!
This thread was automatically locked due to age.
