SES triggers many events: Browser navigation to known bad URL attack detected but not blocked

Products

• Complete Endpoint Defense (with SEP)

Issue/Introduction

In SES/ICDm (Integrated Cybersecurity Defense manager) console administrator might see similar events that state "Browser navigation to known bad URL attack detected but not blocked".

 

Environment

SES/ICDm, 14.3 RU1+

Cause

The Antimalware policy is configured with the default intensive protection settings:

2 for Block and 4 for Monitoring, check the explanation of these settings in the following technical documentation: Using Intensive Protection settings

The URL detected is classified as Compromised site per WebPulse reputation database, this can be checked  by going to this page: WebPulse Site Review Request

Because the monitoring level was configured to Level 4, this URL was detected, and flagged by the IPS.

However the intensity level for Blocking Level is configured in case of default settings to 2, which does allow opening such compromised URLs

Per documentation Level 2:

Blocks or logs the files that are most certainly bad or potentially bad files.

Results in a comparable number of false positives and false negatives.

Hence the logs seen in your Cloud console are correct, and SEP works as designed.

Resolution

If the administrator wants to have such URLs blocked as well, then the administrator will need to raise the level of blocking to 4 as the monitoring Level.

Please note, that raising the intensity level might contribute in raising the amount of False Positive detection and conviction, hence please use it with caution.