Increasing amount of Intrusion attempts

[Marcde_J]

Hi, I have a 100E protecting a corporate HO with about 500 devices behind it.

We have 9 public addresses. In the last two weeks we went from having about 2 IPS events a week to 200 every day.

Is there a way to curb this? At the moment I put every IP on an ACL list preventing future attempts from that specific IP, but it just seems to be getting worse?

Attached latest IPS log for info

[DeepKuma2]

Hi,

I saw some "Backdoor.DoublePulsar" in the logs. Is it VIP configured for this system? 

Current action is blocked on the firewall but it is also recommended to verify the DOS, DDOS configuration and Antivirus scanning with SSL along with IPS. 

Offcourse it is critical to the point of security but if you are using well-configured security solution as FortiGate and all client machines are up to date with patches, antivirus, host firewall etc. then don't worry.

Regards,

Deepak Kumar