Endpoint Protection

I run Symantec Endpoint Protection on my VPS and apparently it is doing its job, as I get an occasional email stating the a high-risk intrusion was detected...

However, in the last 2 days, I 've received over a 100 of these emails.

The targeted port in the email is 0

Is there a probelm I should investigate further?

Is the traffic going outbound from the VPS? If so, it may have an active infection.

If you could post a screenshot of the full alert that would be great.

Hi Brian,

Here is a screenshot.

It looks like that remote IP attemtped to exploit the system but was blocked by SEP.

You could drop this traffic at your firewall as well but so far SEP is doing its job.

Brian, how would I go about "dropping" the traffic at my firewall?

Also, is there a way to see what ip-addresses these attacks are coming from and what port they are attempting to use?

The email from Symantec regarding the blocked High-Risk Intrusion always says port 0, but I suspect it is really another port?

Is the address in the 'Target IP' your external address?

Yes the Targeted IP is the address for my VPS

Hi Brian,

did you see my last response:  The Targeted IP is the address for my VPS.  I'm still interested in knowing how to find out the ip address of the attackers, and what port they were attacking.

Thanks

To me, that alert offers no relevant detail whatsoever.

May want to contact support to see what they know.