atWORK

Hi, I know this might be a silly question but then why would our server go down when there is this network attack on our system? Is kaspersky blocking an attempt not sufficient enough than to take the whole web server down?. We are running IIS as the application Event 'Network attack detected' has occurred on device [DEVICE-NAME] in Windows domain [DOMAIN-NAME] on 2022-01-20T21:31:02 User: DOMAIN\Username (Active user) Component: Network Threat Protection Result description: Blocked Name: UMIDS:Intrusion.Generic.CVE-2021-44228.a Object: TCP from 192.168.X.X at 192.168.X.X:80 Object type: Network packet Object name: TCP from 192.168.X.X at 192.168.X.X:80 Additional: 192.168.X.X Database release date: 2022/01/20 01:41:00 PM NB: Endpoints in bold is the ip address of the server affected.

Looks like the above version of kaspersky has some bug(s) in it. So far I had two devices where internet connection was getting blocked by self-defence. After updating to version 11.7.0.669 it got resolved.

Hello, Which Kaspersky software name, version & patch(x) x=letter, is installed? It’s a cloud plus Yes it was installed about a week ago No I cannot find any similar error in the reports

Hi Igor, Is this the reason a device would show critical for this specific topic? It’s also running windows 11 but shows windows 10