(Central Server) has been communicating with suspicious IP

Question

RojoLoco wrote:How-to, posted by AlienVault:http://community.spiceworks.com/how_to/86147-how-to-investigate-alienvault-threat-alerts-in-spicewor...Yeah, I think I read this one once. It boils down to, "look up the IP address and think about what you find critically, then decide what to do from there."AlienVault will give you a threat score. I think I've seen as high as 2-3 but never higher (it's out of 10) on the links to their page. I usually paste the IP address into virustotal.com to determine if it's something I should be concerned about.Beyond that, I'm not sure what you'd be able to do aside from check for malware,block the IP addresses at the gateway, which, if you're getting a lot of them could be a tedious, losing battle, or, I guess you could rebuild those machines.Sometimes I get the feeling that, if it's a workstation,...

Answer 1

I am getting these in spiceworks much more recently. Links point to an Alienvault for remediation. What is this?, becauseI am not seeing any elevated threats on my Palo Alto FirewallAll that is being said in my Spiceworks is the following:(Central Server) has been communicating with suspicious IP204.11.56.48. View Threat Details.(Central Server) has been communicating with suspicious IP 46.165.220.157. View Threat Details.(Central Server) has been communicating with suspicious IP 173.201.20.173. View Threat Details.(Central Server) has been communicating with suspicious IP 104.207.141.81. View Threat Details.(Central Server) has been communicating with suspicious IP 137.135.101.1. View Threat Details.(Central Server) has been communicating with suspicious IP 23.253.10.48. View Threat Details.(Central Server) has been communicating with...
This topic first appeared in the Spiceworks Community