cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Highlighted
ED
Silver

Infected hosts shows non internal IP

Cyber Attack View

Infected hosts shows an IP address that is not internal. 

Example:

The log shows from IP-address 198.11.73.103 towards one of our external IP-addresses og security gateway. 

Why does the Cyber Attack View show addresses that are non internal? How should I interpret this? 

Hello Peppa Smiley Happy

Labels (1)
4 Replies
Danny
Pearl

Re: Infected hosts shows non internal IP

Check the definition of your internal network within your SmartEvent configuration.

ED
Silver

Re: Infected hosts shows non internal IP

Thanks Danny. So I need to add the external IP's of the security gateways also there?

0 Kudos
Danny
Pearl

Re: Infected hosts shows non internal IP

Jep.

0 Kudos
Vladimir
Pearl

Re: Infected hosts shows non internal IP

Danny,

I'd like some clarification on this subject.

I too see occasional external host listed as "Infected":

image.png

 

"Internal Network" does not contain this IP or the network it belongs to.

Why is it being reported to me?

0 Kudos