Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Jameson
Community Record
22
Posts
33
Kudos
1
Solution
Badges
Jan 18 2024
2:13 PM
Wanted to follow up here. We received the below message from Meraki today. I verified that the search was working. With the working search, we could see that one of our internal domains is being flagged as "Advertisements", which we block. Yesterday, it wasn't showing a category in the Meraki "event log". It is now showing the "Advertisements" category on any domain or subdomain using that internal root domain. We do own the domain, so we are not sure how it was flagged as "Advertisement" as it's not used externally. Response from Meraki: Thank you for your patience as the engineering team has been able to work on providing a solution. I received word from the Engineering team that this issue has been resolved.
... View more
Jan 17 2024
11:24 AM
That is our experience as well. We have multiple sites over Site-to-Site VPN as well as remote workers on Client VPNs (multiple firewalls hosting Client VPN). The local sites are blocking some internal URLs. Also, it wasn't all sites, but likely was moving that direction. It started with reports at one, then two, then Client VPNs, then another site.
... View more
Jan 17 2024
11:07 AM
2 Kudos
Meraki Just responded to our ticket: We are aware of the issue and currently, the Engineering team is investigating the matter. When attempting to use the URL check, it returns a server error 500. Our team is working diligently to resolve this issue. If you would like to check with the category it's in right now, as a workaround Meraki leverages BrightCloud. If you'd like to use a URL checker, BrightCloud has one available - https://www.brightcloud.com/tools/url-ip-lookup.php
... View more
Jan 17 2024
11:02 AM
When checking the network traffic in the background, I can see the following error after attempting to check the URL category. Seems related to something on the Meraki server side and their licensing of Sentry. detail: "Sentry dropped data due to a quota or internal rate limit being reached. This will not affect your application. See https://docs.sentry.io/product/accounts/quotas/ for more information." Also, the item before it in the loaded pages is a failed page from meraki: Server error The server encountered an error and could not complete your request. A message has been sent to our engineering and support teams to notify us of the problem, and we will fix it as soon as possible. The Cisco Meraki Dashboard is temporarily unavailable, but rest assured your Meraki equipment is still running and network operation has not been interrupted. Learn more about Meraki's out-of-band control.
... View more
Jan 17 2024
10:38 AM
We started having this issue as well about 30 minutes ago. Some internal sites are being blocked. When we attempt to check the category in Meraki, it fails. Our "workaround" has been to add the internal site to the meraki "allow list". Our IT Manager is on with Meraki support right now. They are saying there are no issues reported relating to this. We also submitted a ticket.
... View more
Apr 13 2023
1:00 PM
We recently purchased a FortiGate because of this exact issue. If you get a different response than "sorry we don't do that" from support, could you please share? Outside of this issue and the lower bandwidth capacity (dollar for dollar when compared to FortiGate), we were very happy with the Meraki MX line and would rather use them.
... View more
Apr 13 2023
12:54 PM
1 Kudo
Following up... This file is now marked as "clean" for me and is no longer appearing in the dashboard alerts. I believe this has been "resolved"
... View more
Apr 13 2023
12:50 PM
Following up.. All 3 files are now marked as clean and have fallen out of my alerts. For me, this issue appears to be completed "resolved".
... View more
Apr 13 2023
11:36 AM
Wanted to follow up here to see if others are experiencing the same thing we are. (tagging @ConnorL from Meraki) Meraki marked the issue as "Resolved" on this post [RESOLVED] Security Center False Positive Alert - April 13th 2023 - The Meraki Community However, we have had a total of 3 files that triggered Malware alerts today. So far 2 of the 3 are showing as "Clean" in the dashboard. Ultimately, I'm trying to determine if this "resolution" is for all of the files or just the two currently marked as "clean"? File 1: [CLEAN] W32.7F4CBDDDA2.RET.SBX.TG - 7f4cbddda24faf170473706c062c8957d6bb422b285013c932c61e8dd4efb381 File 2: [MALICIOUS] W32.0E9CF9601C.RET.SBX.TG - 0e9cf9601c14abd31bb02adfa0986ceb78af596cbd991e6cad89fe80ea959abd File 3: [CLEAN] i640.c2rx (W32.7B9E2002CA.RET.SBX.TG) -- 7b9e2002cacef4817353464f9845e294845daef8b28adeab55e76b3c8278ff18
... View more
Apr 13 2023
10:18 AM
We are also following this new issue on this post: 2nd Malware Detected - i640.c2rx - The Meraki Community
... View more
Apr 13 2023
10:16 AM
1 Kudo
We have seen this filename before ( i640.c2rx on 9/7/2022) but the SHA256 hash that we are getting back is different this time. Also, when I search VirusTotal for the SHA256 hash, it doesn't find anything. When I download the file from the URL that is blocked by the FW, that file has a different SHA256 hash that is in VirusTotal. I'm not sure what is going on
... View more
Apr 13 2023
10:13 AM
1 Kudo
We are in the "Mee too" Category! Thanks for starting a seperate thread. Source Location: b.c2r.ts.cdn.office.net File: i640.c2rx (W32.7B9E2002CA.RET.SBX.TG) SHA256: 7b9e2002cacef4817353464f9845e294845daef8b28adeab55e76b3c8278ff18 First notification was received: 4/13/2023 11:04 AM Eastern
... View more
Apr 13 2023
9:39 AM
We are now getting a new alert for the below file. Anybody else? Source Location: b.c2r.ts.cdn.office.net File: i640.c2rx (W32.7B9E2002CA.RET.SBX.TG) SHA256: 7b9e2002cacef4817353464f9845e294845daef8b28adeab55e76b3c8278ff18
... View more
Apr 13 2023
8:28 AM
2 Kudos
For most up-to-date information go to these two posts: Malware Detected - The Meraki Community Security Center False Positive Alert - April 13th 2023 - The Meraki Community
... View more
Apr 13 2023
8:24 AM
Just had an additional file start popping up. URL root is: 1d.tlu.dl.delivery.mp.microsoft.com File: W32.0E9CF9601C.RET.SBX.TG SHA256: 0e9cf9601c14abd31bb02adfa0986ceb78af596cbd991e6cad89fe80ea959abd
... View more
Apr 13 2023
8:16 AM
Following the same issue in our environment on this post as well: Re: MX Malware Blocking - The Meraki Community
... View more
Apr 13 2023
8:03 AM
Following the same issue in our environment on this post as well: Re: MX Malware Blocking - The Meraki Community
... View more
Apr 13 2023
7:56 AM
1 Kudo
We are now getting an additional file marked with different hashes. Also from [3-11].tlu.dl.delivery.mp.microsoft.com W32.7F4CBDDDA2.RET.SBX.TG - SHA256: 7f4cbddda24faf170473706c062c8957d6bb422b285013c932c61e8dd4efb381
... View more
Apr 13 2023
7:49 AM
1 Kudo
I just attempted to post about this and Meraki marked it SPAM. We are seeing thousands of these notification (over 9000 at time of writing). Our alerts started at 10:28 AM Eastern on 4/13/2023. File SHA256 hash: 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562
... View more
Apr 13 2023
7:44 AM
We are receiving thousands of (9000+ so far) retrospective malware detections as of about 10 minutes ago (4/13/2023 10:26 AM Eastern) SHA256: 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b3 Filenames: ArchiveFile and W32.975C0D48C4.RET.SBX.TG All of the download locations so far appear to to be Microsoft. Some Example URLs below. MERAKI AMP TEAM -- Is this legit or a false positive????? VirusTotal to SHA256: VirusTotal - File - 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562 http://9.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3d3c4265-57fd-450e-9bda-9fb5f4612029?P1=1681368574&P2=404&P3=2&P4=gL0EXIXwIkJJhFEyd1wRq%2b0nryYmmoR8nWmQGVPuncPXgA2VkYtArKEodJkwF58%2fzeENTFl5iEeqQY46jHIAQg%3d%3d http://4.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3d3c4265-57fd-450e-9bda-9fb5f4612029?P1=1681396951&P2=404&P3=2&P4=ERdkT2FZp8lWWqXEGkbQhD%2bBI%2bdPLFdN3ARlq%2fYyzodElOCU7UGST3%2fcEX9F5CBVrsFvL4AfNbSI3fSCUXsNSQ%3d%3d http://11.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3d3c4265-57fd-450e-9bda-9fb5f4612029?P1=1681351034&P2=404&P3=2&P4=cwd%2fNLXN1R9GBaKi8qQ3HoyXjg6wPKOz0sjvJ1Sfhi9iCWMrE1Fei6x%2fZ8wnoo8AeDeCtLI4fjkVBnJ8YEpWTQ%3d%3d
... View more
Labels:
- Labels:
-
Firewall
Sep 7 2022
5:26 AM
We fall into the "us too" category. SHA256: d73298c7c8b8ce78f7003cf6832a8dd719ab4d240cf3e213fcf8824539c81873 Filename: i640.c2rx Type: Zip Size: 1048576 bytes URLs: http://b.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.15601.20088/i640.c2rx http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.15601.20088/i640.c2rx
... View more
Aug 1 2019
7:03 PM
24 Kudos
Just Got off the phone with Meraki Support. Representative said that it was a False Positive and AMP was blocking windows updates. Engineering was working to get it resolved. I had already opened a ticket so he posted the below information to the ticket and said the ticket would be updated when engineering had more information. PROBLEMS DISCUSSED: - AMP blocking Windows update. ------------------------ ACTIONS TAKEN: - File in question: W32.779C90C974-100.SBX.TG ------------------------ NEXT STEPS: - Further investigate this malicious activity. - Keep the customer posted with updates.
[Mod note 1 August: Marking as solution for greater visibility!]
[Mod note 2 August: Un-marking as solution now that we have an update from Raj at Meraki]
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2601 | Apr 13 2023 8:28 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 24 | 62752 | |
| 2 | 3769 | |
| 2 | 2601 | |
| 1 | 4991 | |
| 1 | 5260 |
© 2024 Cisco Systems, Inc.
