ATP alert

Can anyone suggest on the below query

ATP Event reoccurs every two to three days.

2021:04:13-01:45:20 nwusophos01 named[5282]: rpz: client @0xa519a18 ( view default: rpz IP NXDOMAIN rewrite via

measurements already taken:
- enable DNS diagnostic logging on Microsoft active directory domain controller/dns server.
- match dns query to atp event: querying system is domain controller (
- scan of domain controller with customer's antivirus software
result: clean
- scan with sophos virus removal tool
result: clean

Firmware version: 9.705-3
Pattern version: 197682

We need verfiy if ATP alert is a false postive or not. Please assist.

Added TAG
[edited by: emmosophos at 8:44 PM (GMT -7) on 14 Apr 2021]
Parents Reply Children
  • is a well known bad host. annoying us since a while, too.

    would be nice if Sophos would block this IP.

    currently only traffic replies of machines behind the firewalls (XG or SG) are blocked by ATP. and this is causing alerts from the firewall each time.