topic Re: DNS Reputation Generic.TC.kmcpxf in Firewall and Security Management

DNS Reputation Generic.TC.kmcpxf

KirillEPM — Wed, 24 Nov 2021 08:12:36 GMT

Good day! Please tell me how can block requests of this kind?
Thanks.

Re: DNS Reputation Generic.TC.kmcpxf

_Val_ — Wed, 24 Nov 2021 08:14:50 GMT

It is on Detect because confidence level is Low. Go to DNS reputation protection and change action from Detect to Protect. Mind, with confidence Low you will get some false-positives.

Re: DNS Reputation Generic.TC.kmcpxf

KirillEPM — Wed, 24 Nov 2021 09:14:36 GMT

Did I understand correctly that the actions need to be performed here?

Re: DNS Reputation Generic.TC.kmcpxf

Chris_Atkinson — Wed, 24 Nov 2021 11:40:23 GMT

Under "Forensic Details" what does the expanded Description field say?

Re: DNS Reputation Generic.TC.kmcpxf

KirillEPM — Wed, 24 Nov 2021 12:11:08 GMT

it says here:

Re: DNS Reputation Generic.TC.kmcpxf

_Val_ — Wed, 24 Nov 2021 12:56:55 GMT

Yes. The action is per profile. DO NOT change the three default profiles, create a new one based on one you are currently using, change there, and then re-apply the new profile to your Security Gateway.

Re: DNS Reputation Generic.TC.kmcpxf

Chris_Atkinson — Wed, 24 Nov 2021 13:12:02 GMT

I think this isn't the correct screenshot, I was referring to the "Log Details" screen above.

Re: DNS Reputation Generic.TC.kmcpxf

KirillEPM — Wed, 24 Nov 2021 13:18:59 GMT

Re: DNS Reputation Generic.TC.kmcpxf

Chris_Atkinson — Wed, 24 Nov 2021 14:09:10 GMT

Such a message usually implies that Anti-bot has blocked the communication, you should review the SK referenced and search for log entries with the trap IP to correlate/verify.

In R81 and above we changed the logging action in such instances to indicate traffic was blocked.