This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
ABOUT CHECKMATES & FAQ
Create a Post
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Help

Are you a member of CheckMates?

×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
Olga_Kuts
Advisor
‎2018-05-30 06:26 AM

SandBlast Agent Anti-Bot exception

Are there any official recommendations from Check Point on adding exceptions to the SBA Anti-Bot blade?
For example, we have the Anti-Bot blade incident when the user accesses the UserCheck of Application Control blade. How to explain this behavior for customer?

2 Replies
Steve_Lander
Collaborator
‎2018-06-26 01:06 PM

Not sure if there are any official recommendations, but you can exclude different types of things for Anti-Bot.  If there is a specific process (such as a development application) that keeps triggering Anti-Bot because its trying to go out somewhere legitimately, you can try to exclude that process.  We have some of our internal domains excluded for that reason.  

Doron_Zuckerman
Employee
Employee
‎2018-07-01 11:35 PM

Hi Olha,

 

There are no recommendations for exceptions.

Analyzing your logs, a "Trojan.Win32.Ponmocup.I" bot was found by AntiBot.

The URL used is related to User check simple configuration in Smart dashboard which is configured by the user, hence may contain links which are recognized as malicious.

I suggest to replace it.

A ticket can be opened to TAC team for additional assistance with this issue.

 

Regards,

Doron Zuckerman