DNS trap

[Adnan_Saleem]

We have been getting LOT of alerts from our SIEM about Checkpoint IPS/Anti-Bot considering fastly.net domain as malicious and preventing it! We initially quarantined 200 assets before we could find in forensics that the Resource is fastly.net. Which is a false positive! Checkpoint support confirmed this too. Wondering how many pissed off today with these alerts?

[Patrick_Taphorn]

This false positive for fastly.net hit us too.   Glad to hear Checkpoint Support actually confirmed this was indeed a false positive.   Had some angry end-users here.

[VikingsFan]

We were seeing similar today.  Thanks for confirming with support.

[the_rock]

Thanks for sharing.

Andy

[PhoneBoy]

False positives should always be reported to TAC, which it appears a few people did in this case.

[Daniel_Kavan]

Rather than having to go thru submitting a case, maybe we could have a community share page where we can check in TO SPEED UP THE PROCESS and get the word out.   This is great as it is though.  I certainly had major heat yesterday for this.   Is it safe to turn DNS trap back on?

[the_rock]

Good idea.

[VikingsFan]

Our alerts stopped around 6PM EST yesterday.

[PhoneBoy]

Reporting the issue in the community as was done in this and other similar cases helps get the word out.
Unfortunately, we do not have a more formal place to track this short of individual SK articles for specific "false positive" events.
The TAC case is to ensure the problem is properly tracked and resolved.

[VikingsFan]

Is this something that Check Point would typically send a notification out to customers?  If so, how do I get on that mailing list?

[John-Haynes]

I went to look into the same issue yesterday, but otx.alienvault.com was getting blocked as Glupteba.TC.804cfguz 😞

[the_rock]

I just literally realized it was same issue I dealt with the client yesterday when you said the name Glupteba. Glad to know it was known issue, but yes, raised false amarms.

Andy