1550 hosts encountered an exploit attempt

G_W_Albrecht — Thu, 05 Dec 2019 08:51:18 GMT

CheckPoint SmartView is a good tool for log reviews with its templates like Attacks Allowed by Policy. During IPS profile testing on the 1550 - you had to limit IPS protections in a special SMB profile with the older Embedded GAiA models while 1550 / R80.20 now has a TP policy like all GAiA GWs do - i also used SmartView. This gave me an odd encounter i would not have expected: hosts encountered an exploit attempt ! Have a look:

The 1550 FifteenFifty 😊 is managed by SMS7520 🙃 and set to send Security Logs and Syslog there. Seems not to be easy with Syslog, though:

Matthaeus 5:30:

And if thy right hand offend thee, cut it off, and cast it from thee 8)

1550 hosts encountered an exploit attempt

G_W_Albrecht — Wed, 19 Feb 2020 11:20:40 GMT

Now these messages have vanished from SmartView...

topic 1550 hosts encountered an exploit attempt in Spark Firewall (SMB)

1550 hosts encountered an exploit attempt

1550 hosts encountered an exploit attempt