IPS logs DNS.PTR.Records.Scan Question

[Ninja_03092]

Hello 

I am getting a large number of entries related to the DNS.PTR.Records.Scan signature. The origin is one of my servers making requests to 8.8.8.8 or 1.1.1.1

What actions do you recommend?

eventtime=1725978564223549647 tz="-0400" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=19.19.12.101 srccountry="Reserved" dstip=8.8.8.8 dstcountry="United States" srcintf="z2" srcintfrole="wan" dstintf="Internet" dstintfrole="wan" sessionid=88096527 action="dropped" proto=17 service="DNS" policyid=229 poluuid="79818ba8-59a9-51ef-f294-51bc44ab72d9" policytype="policy" attack="DNS.PTR.Records.Scan" srcport=59436 dstport=53 direction="outgoing" attackid=51391 profile="high_security" ref="http://www.fortinet.com/ids/VID51391" incidentserialno=45804839 msg="name_server: DNS.PTR.Records.Scan" crscore=5 craction=32768 crlevel="low"

[Anthony_E]

Hello Ninja,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[AEK]

Hello Ninja

According to Fortinet on http://www.fortinet.com/ids/VID51391 the IPS action for this signature is "pass" by default.

As this is a false positive, go to the IPS profile you are using, search for the signature DNS.PTR.Records.Scan signature, and set action to "Allow".

[sw2090]

Just for info: a DNS PTR Record is nothing evil ;) PTR records are used for reverse DNS which means you ask the DNS for a FQDN to an ip.