Traffic log Category: command-and-control

Marco.Dermitzakis — Tue, 05 Nov 2024 11:15:11 GMT

hello,

can someone please explain to me why I observe logs from an external ip of Type: TRAFFIC, Category: command-and-control

Action: drop.
Shouldn't the category trigger for connections made from inside out ?
Also, why it generates Traffic logs and not Threat logs?

Thank you

Re: Traffic log Category: command-and-control

OtakarKlier — Wed, 06 Nov 2024 18:28:24 GMT

Hello,

Review your inbound policies and see what inspections you have on the traffic. Typically I dont enable URL filtering on inbound traffic.

Regards,