topic issue with manual IOC in Firewall and Security Management

issue with manual IOC

unleashed — Sun, 16 Jun 2024 20:03:00 GMT

we configured a policy to block IOCs. IP objects and domain objects. we encounter a wired behavior that, randomly, Check Point blocks legitimate IP addresses.

for example, we have added domain marl.com in the domain object to be blocked. Suddenly CP block google DNS 8.8.8.8, when we check the logs, it shows that 8.8.8.8 blocked because it's belonging to domain marl.com which is already added in IOC object. however, when we resolve the domain marl.com on the gateway it shows IP is 172.35.*. *

any clue why this happened?

Thanks,

Re: issue with manual IOC

PhoneBoy — Mon, 17 Jun 2024 23:30:54 GMT

The Occam's Razor answer is that it appears that, at least briefly, marl.com did resolve to 8.8.8.8.
Why that happened would likely require further investigation.

Re: issue with manual IOC

the_rock — Tue, 18 Jun 2024 03:07:01 GMT

Might need TAC case to check this further.

Andy