why are external hosts shown as "infected"

[Marc_Lampo]

Hello,

although, via the (old) SmartEvent GUI, the internal network is defined, for SmartEvent, I notice that the "Threat Prevention" view keeps showing *external* IP addresses as "infected".  I would have thought only internal addresses are candidates here.

Showing external addresses as well makes the list unnecessary long and the risk of overlooking internal hosts increases.

What am I missing ?

Regards,

Marc

[ED]

Hi Marc,

Take a look at this thread: https://community.checkpoint.com/t5/Logging-and-Reporting/Infected-hosts-shows-non-internal-IP/m-p/2... 

[Danny]

You are missing the custom filter to show only traffic deriving from your internal network.