About EJaspe

Hi Ymiyahista,   Sorry if I reply on this thread. Yes, I will create new thread if I have a new questions/concerns. By the way, here is my answer to your question to my question. - Are you seeing the threat log "HTTP Unauthorized Brute Force Attack - ID 40031" which destination IP address is the fileserver? If so, the fileserver is also running as a web server, right?  Please help us clarify your questions. - Are you seeing the threat log "HTTP Unauthorized Brute Force Attack - ID 40031" which destination IP address is the fileserver? If so, the fileserver is also running as a web server, right? The destination address is from our internal fileserver itself. the source IP Address is our client's endpoint. Our client's endpoint is connected to our internal network and he is accessing it within our premises. As per our Data Center Admin, our fileserver is running locally and not by web access.   - Do you want to know if the web access was performed by using IP address or hostname? In that case, you can look at the HTTP Host header. The logging must be enabled on the web server to see it in the log. Or you can capture the traffic and check. By accessing our fileserver, our endpoints should connected to our internal network. If the endpoint is outside the premises, they access the fileserver by connecting to VPN and access it locally.  ... View more

Hello All,  We have a fileserver within our internal network and they can access it locally by hostname. I would like to ask, how if this alert is from internal access and not from external IP? How would I know if they using web browser to access the IP of the server? Shall I ask our Data Center Admin to check the fileserver?   Thank you in advance! ... View more