SandBlast Agent Anti-Bot exception

[Olga_Kuts]

Are there any official recommendations from Check Point on adding exceptions to the SBA Anti-Bot blade?
For example, we have the Anti-Bot blade incident when the user accesses the UserCheck of Application Control blade. How to explain this behavior for customer?

[Steve_Lander]

Not sure if there are any official recommendations, but you can exclude different types of things for Anti-Bot.  If there is a specific process (such as a development application) that keeps triggering Anti-Bot because its trying to go out somewhere legitimately, you can try to exclude that process.  We have some of our internal domains excluded for that reason.  

[Doron_Zuckerman]

Hi Olha,

There are no recommendations for exceptions.

Analyzing your logs, a "Trojan.Win32.Ponmocup.I" bot was found by AntiBot.

The URL used is related to User check simple configuration in Smart dashboard which is configured by the user, hence may contain links which are recognized as malicious.

I suggest to replace it.

A ticket can be opened to TAC team for additional assistance with this issue.

Regards,

Doron Zuckerman