Security Logs

gazette — Wed, 15 Sep 2021 03:25:12 GMT

Hello, I have recently had some doubts about some security logs in a 790 firewall, such as the following three examples:

Both the source and the destination are servers on the same network segment, for example 180.80.0.0/24. The three events shown are sourced by the same server (180.80.0.10) but at two destinations (180.80.0.13, 180.80.0.14). This leads me to think that the 180.80.0.10 server has malware, but it has the Harmony Endpoint installed, I have verified and everything seems to be fine.

But the alerts keep coming constantly, what can I do in this case?

While on the other console of the 790, it tells me that it is infected.

Re: Security Logs

PhoneBoy — Wed, 15 Sep 2021 05:29:09 GMT

Could very well be false positives.
Packet captures and a TAC case are definitely in order.

Re: Security Logs

G_W_Albrecht — Wed, 15 Sep 2021 08:21:21 GMT

I would assume a false positive as the traffic is local, not to a C&C server...

topic Security Logs in Spark Firewall (SMB)

Security Logs

Re: Security Logs

Re: Security Logs