I do not need a solution (just sharing information)
I have SEP installed on a webserver with IPS module enabled. There was an inbound connection which was detected by SEP IPS under apache struts signature and got blocked. Post which an outbound is detected by the same endpoint IPS on server under a different signature and was blocked again.
My concern is "when IPS said that the inbound was blocked the webserver shouldn't even respond to the actual request, but why is there an outbound for the request? " Isn't the IPS actually blocking ?? or am i missing anything here.
0