Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Marc_Lampo
Contributor

why are external hosts shown as "infected"

Hello,

although, via the (old) SmartEvent GUI, the internal network is defined, for SmartEvent, I notice that the "Threat Prevention" view keeps showing *external* IP addresses as "infected".  I would have thought only internal addresses are candidates here.

 

Showing external addresses as well makes the list unnecessary long and the risk of overlooking internal hosts increases.

 

What am I missing ?

 

Regards,

 

Marc

0 Kudos
2 Replies
ED
Advisor

Danny
Champion
Champion

You are missing the custom filter to show only traffic deriving from your internal network.

image.png