Advanced Threat Protection

Hi

Starting today I have got exactly the same warnings. The shown source ip is also outside of my local network.

part of it is configuration of your dns.  in order for ATP to work correctly you need to have all dns requests go to the firewall FIRST.  if you are not using the firewall for dhcp then set primary dns in dhcp as the firewall.

If you are using AD then you also need to setup dns routing under dns in the webadmin so the firewall will route internal dns requests to your AD server/s.  Then you will get proper alerts for internal machines...:)

Sadly this wasn't an internal issue, this was a potential attack (unconfirmed if DNS reflect or otherwise) that seemed to come from China.

This happened regardless whether it was the primary DNS or otherwise in investigations with others and customers.

You aren't wrong however, best practice is to have DNS requests hit the UTM first and perform request routing :)

Emile

Sadly this wasn't an internal issue, this was a potential attack (unconfirmed if DNS reflect or otherwise) that seemed to come from China.

This happened regardless whether it was the primary DNS or otherwise in investigations with others and customers.

You aren't wrong however, best practice is to have DNS requests hit the UTM first and perform request routing :)

Emile

I have never seen ATP alert externally unless there was a misconfiguration...interesting.  IPS is usualy the one to alert to an external threat..:)

ATP actually works both ways but it primarily only operates on In -> Out and generally IPS only works on Out -> In but this is one of the rare occasions where ATP picked up a malicious DNS request on externally blocked packets. It was a very odd thing to have happened!

It is very weird!

Emile

ATP was designed to scan only outbound traffic, like it was officially documented:
"New in UTM version 9.2 Sophos has introduced Advanced Threat Protection (ATP) which monitors traffic leaving your network to detect compromised computers"

FYI, this incident was reported as a BUG in the answer from Sophos support.

Aha, didn't see that, thanks for the information!

A bug would make sense, different people say different things and I guess I heard wrong regarding ATP :)

Cheers,

Emile

In one of the previous post I mentioned that I remember that question was included in my Sophos UTM Engineer online exam. They insisted on knowing that fact, so this incident was complete surprise for all of us (and also for them, I guess...;).