locked
Webex causing Reconnaissance using SMB Session Enumeration? RRS feed

  • Question

  • Hello,

    I have the confirmed information from Microsoft that the websense servers might indicate false positives in terms of the "Reconnaissance using SMB Session Enumeration" ATA alerts.

    I detected a user who triggered off the creation of such an alert in my environment and he was using Webex that day.

    Now since Webex is software from Websense, shall we say that it's a logical explanation for this particular alert?

    How would you approach this?

    Thank you very much in advance.

    Regards,
    MSSOC
    Friday, December 22, 2017 7:43 AM

Answers

  • If running the software reproduces the alert on demand, I would say you found a good explanation.
    • Marked as answer by MSSOC Saturday, December 23, 2017 6:51 AM
    Friday, December 22, 2017 8:46 PM