Hello All,
I am investigating the issue of why some IPs logs are showing the action "Detected" in stead of "Prevented" as per the TP Policy. We can see from the logs that the log4js is being logged as "Detect". the log entry shows that it is matching the expected TP policy rule, using the correct TP Profile. The TP Profile is set up to Prevent anything with Confidence level Medium that is included.
The one thing I notice is that the destination for the traffic is the public IP of the FW itself and that for some reason this affects the FWs ability to "Prevent" the traffic in the IPS.
The Logs show that the lo44js is only Detected:
The policy rule matched is set up to prevent things of medium confidence or higher:
We can see that the log4js protections are set to "Prevent"
Is the destination being the FWs public IP on port 80 what is causing the strange behaviour?
Many thanks,
Michael
