issue with manual IOC

[unleashed]

hi 

we configured a policy to block IOCs. IP objects and domain objects. we encounter a wired behavior that, randomly, Check Point blocks legitimate IP addresses. 

for example, we have added domain marl.com in the domain object to be blocked. Suddenly CP block google DNS 8.8.8.8, when we check the logs, it shows that 8.8.8.8 blocked because it's belonging to domain marl.com which is already added in IOC object. however, when we resolve the domain marl.com on the gateway it shows IP is 172.35.*. * 

any clue why this happened?

Thanks,

[PhoneBoy]

The Occam's Razor answer is that it appears that, at least briefly, marl.com did resolve to 8.8.8.8.
Why that happened would likely require further investigation.

[the_rock]

Might need TAC case to check this further.

Andy