Risk level

Question

Hello! I just integrated Sophos Alert with my Service Desk software to open tickets regarding high risk alerts with Intrusion Prevention and Advanced Threat Protect. Fortunately most of them are alerts of temporary files, cache or even false positivos and they disappear in next day or few days. However there are some that need attention if they persist. So I created a scheduled ticket every week to check SUM and see if there are any major threats. Regarding only security level (Threat), what risk level should I take an action in this print: 
 
 Thank you!

DouglasFoster · Answer

I assume that you have ATP configured to BLOCK mode, not simply alert! 
 I have seen ATP errors mean one of these things: 
 
 Someone browsed to an infected website, which tried to redirect them to something bad, and UTM blocked the action. No harm done. 
 Something tried to do a DNS lookup on a name that UTM always blocks. Name not resolved, no harm done if this is a random event, UNLESS the requester is able to bypass the UTM block by querying a different DNS server! Spam-getting-through is one way this could happen. If someone tries to click a bad link, ATP might block the DNS lookup before Web Filter has a chance to evaluate the URL reputation. Related: I have a non-UTM email filter that checks every URL, and blocks the suspicious ones. I had to exempt it from IPS/ATP filtering so that UTM did not block the DNS request (which might cause the email filter to conclude that the URL is harmless). 
 However, it might mean that the source PC is actually infected, and is trying to download instructions and payload. UTM blocked the attempt, but it may have more than one way to do its dirty work. This requires taking the PC off the network immediately and getting it disinfected.