topic SandBlast Agent Anti-Bot exception in Endpoint

SandBlast Agent Anti-Bot exception

Olga_Kuts — Wed, 30 May 2018 13:26:56 GMT

Are there any official recommendations from Check Point on adding exceptions to the SBA Anti-Bot blade?
For example, we have the Anti-Bot blade incident when the user accesses the UserCheck of Application Control blade. How to explain this behavior for customer?

Re: SandBlast Agent Anti-Bot exception

Steve_Lander — Tue, 26 Jun 2018 20:06:46 GMT

Not sure if there are any official recommendations, but you can exclude different types of things for Anti-Bot. If there is a specific process (such as a development application) that keeps triggering Anti-Bot because its trying to go out somewhere legitimately, you can try to exclude that process. We have some of our internal domains excluded for that reason.

Re: SandBlast Agent Anti-Bot exception

Doron_Zuckerman — Mon, 02 Jul 2018 06:35:55 GMT

Hi Olha,

There are no recommendations for exceptions.

Analyzing your logs, a "Trojan.Win32.Ponmocup.I" bot was found by AntiBot.

The URL used is related to User check simple configuration in Smart dashboard which is configured by the user, hence may contain links which are recognized as malicious.

I suggest to replace it.

A ticket can be opened to TAC team for additional assistance with this issue.

Regards,

Doron Zuckerman