DNS Server Rule - Action Change to Prevent from

[r1der]

Hi Everyone,

Question about this rule/malware trap dns setup.
This rule exists for our DNS Servers under Threat Prevention > Policy.
I forgot if I made this rule or not. I think I made this rule because the DNS servers were being listed as "Infected Hosts" for DNS requests to C&C sites. 
So in an attempt to find out the actual clients, I ended up looking at the Malware Trap DNS setup. These DNS servers are the same defined in Malware Trap DNS setting.

If I am not mistaken, the next step is to change Action = PREVENT.  However, I noticed that after doing that some of the sites it started PREVENTING were actually legitimate and I switched it back to Detect. Note: last 2 at the very bottom of screenshot below are indicators I have uploaded via CSV. 

By changing the rule action from Detect to Prevent, it would seem like I'd have to create exceptions for each false positive.
Is that correct? There seems to be a lot of false positives if I switch to Active, but there also seems to be a lot getting allowed through because my setting is set to Detect. 

I tried disabling the rule just to see the actions, and it seems without this rule it would not allow us to reach sites that CheckPoint thinks is containing malware or is a C&C site. 

Any suggestions appreciated, still a newbie here!

[Chris_Atkinson]

What are the activation mode settings of your current Threat Prevention profile, namely for low confidence protections?

 

Note in R81 and above we altered the logging behavior for DNS trap related events.

[r1der]

Hi Chris, Thanks, Low Confidence = Inactive. We are on R80.40. Screenshot below.
Shouldn't that have meant the sites from the log above (2nd image in original post) with low confidence be allowed?