topic Re: Severity High and medium action are getting allow instead of block in Advanced Threat Prevention Discussions

Severity High and medium action are getting allow instead of block

CyberEye — Thu, 19 Nov 2020 16:04:02 GMT

Hi All,

After upgrade to 9.1.5, i noticed the Severity level high and medium threat actions are allowed and some of them are getting sinkhole. Please let us know if anyone knows why it's getting alert instead of the block in high severity. Attached screenshots

Re: Severity High and medium action are getting allow instead of block

mivaldi — Fri, 20 Nov 2020 20:36:33 GMT

The Severity based rules are for Anti-Spyware. There is no Severity based rules for Anti-Spyware DNS.

For Anti-Spyware DNS, you define actions based on Content DNS signatures, DNS Security DNS Categories, or EDL's of type Domain.

Re: Severity High and medium action are getting allow instead of block

CyberEye — Fri, 20 Nov 2020 21:10:20 GMT

@mivaldi thanks for reply.

So is this expected behaviour? The same url it's getting sinkhole alternatively. I cross checked same in other firewall which is running 9.0 os and confirmed all the high, Medium and critical named as DGA Domain and spyware type are sinkholed.

Re: Severity High and medium action are getting allow instead of block

mivaldi — Wed, 25 Nov 2020 18:40:34 GMT

URL's are HTTP traffic, so they don't get sinkholed. URL's are subject to URL Filtering.

Sinkhole is applied to domains, which is DNS traffic.

Please open a Support case so we can work with you and understand the question better.

We can come back to this post at the end of the case to share our findings with the community.