topic Threat 109020001 detection, dropping LAN traffic after 10.0.0 upgrade in Advanced Threat Prevention Discussions

Threat 109020001 detection, dropping LAN traffic after 10.0.0 upgrade

JonIsaacson — Wed, 22 Jul 2020 14:00:01 GMT

After upgrading from v9.1.3 to v10.0.0, I'm seeing detections for 109020001 (newly registered domain) for traffic to/from addresses in a private class C subnet. It's also taking a drop action.

I can't find the signature in vulnerability profiles to make an exception or change the action. Has anyone else seen this or know where to find it so I can exception or change action?

Re: Threat 109020001 detection, dropping LAN traffic after 10.0.0 upgrade

hisingh — Tue, 28 Jul 2020 16:02:44 GMT

Hello @JonIsaacson

This exception can be added under the spyware profile ->DNS signature-> exception. Please remember that after adding this exception the whole category of "newly register domains" will be whitelisted.

Best

Himani