IOC indicator question

the_rock — Wed, 25 Oct 2023 19:18:58 GMT

Hey guys,

Hope someone can confirm this for me. IOC indicator to block any site works fine (this case facebook.com) and AV blade user check present exactly what you expect to see. But, weird thing is, I find that say with Mozilla, regardless if its private browser windor or not, if I reboot my windows 11 behind lab gateway, works first time I open the browser, page gets blocked, but never after that if browser is closed. Same with Opera browser, but I know not many people use that, so not a big deal : - )

Facebook is constantly blocked fine in IE and Google chrome. I should also add the fact that any category Im blocking (https inspection is enabled) is blocked 100% of the time on any browser.

I could not find any browser limitation in below links, so not sure why this fails.

If anyone has any idea, please be free to share as always.

And remember...ALWAYS be nice to one another.

Thank you!

Andy

https://support.checkpoint.com/results/sk/sk132193

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/Supported-Indicator-Files.htm?tocpath=Configuring%20Advanced%20Threat%20Prevention%20Settings%7CConfiguring%20Threat%20Indicators%7C_____1

Re: IOC indicator question

the_rock — Wed, 25 Oct 2023 19:25:15 GMT

K, found out why Opera GX browser was not working for this. Its below setting, in case anyone has the same issue. Now, just need to find how to fix Mozilla : - )

Andy

Re: IOC indicator question

the_rock — Wed, 25 Oct 2023 19:28:34 GMT

K, got it. I thought it was a proxy, but definitely secure DNS. Anyway, thats the answer if anyone has the same problem.

Thanks guys.

Kind regards,

Andy

topic Re: IOC indicator question in Firewall and Security Management

IOC indicator question

Re: IOC indicator question

Re: IOC indicator question