Anti-Virus and Anti-Bot: time to discuss some strange behavoir

[CheckPointerXL]

Hi all,

time to tune some TP Profile, so i'm going deep into some any-any rule to tune it.

I found some strange logs that i wanna discuss with you:

1)

2)

1) Anti-bot is a know post-infection security feature; i assume that only traffic from internal to external is relevant for this blade.... so, can you help me why anti-bot is triggered for traffic with source internet and destination FW external interface?

2) Anti-virus: it seems that the blade is saying "hey, internet IP is tryng to reach you, but you are a site known to contain malware"... Am i wrong?

thank you!

[_Val_]

1. No, Anti-Bot also helps with prevention. In this specific case, it blocked an apparent scan from Shodan.

2. The second log interpretation is correct, it flagged a malicious site connection attempt.