1/3
SOC alerts troubleshooting and root cause analysis
  

George Fady Lv2  Posted 2026-Oct-21 14:25

Hello Sangfor Community,
I am George Fady, Technical Support Engineer, and I would like to share a practical troubleshooting case related to SOC “Pending Issues” alerts on Sangfor NSF/NGAF.
Problem Description
A customer running an NSF3100A (v8.0.95) reported SOC alerts and asked whether their network was at risk. There was no service interruption. The SOC > Security Operations page showed 224 pending issues:

  • Server Protection (223): “The network object (X.X.X.X) has not been configured security policy”

  • Improper Configurations (1): “DNS proxy server is detected in the internal network, DNS redirection of malicious URLs is not enabled”

These alerts are advisory findings from the risk assessment engine, not an attack or breach.
Root Cause

  • 223 network objects had no Network Security Policy applied, so traffic to them was not being inspected by IPS, WAF or Content Security.

  • An internal DNS proxy existed, but Botnet Detection’s “Local DNS Server Exists” option was not enabled, so malicious domain lookups were not redirected and the real infected endpoint could not be identified.

Resolution Steps

  • Go to Objects → Network Objects and create an IP Group (e.g. “Flagged-Server-IPs”) containing the flagged IPs.

  • Go to Policies → Network Security → Policies → Add → Policy for Server Scenario.

  • Set the source zone to the external zone, and the destination zone and address to the internal zone and the IP group.

  • In the Protection step, enable Intrusion Prevention and Web App Firewall with the default templates, and set the action to Deny.

  • In the Detection and Response step, enable Botnet Detection, set Local DNS Server Exists to Yes, and enter the internal DNS proxy IP.

  • Save the policy, then confirm in SOC → Pending Issues that the alerts are cleared.

Key Takeaway
SOC “Potential Threat” items are recommendations to close policy coverage gaps, not proof of compromise. Grouping the flagged objects into one IP group is much faster than adding policies one by one.
When troubleshooting SOC pending issues, check:
Alert Type → Network Object Coverage → Security Policy Template → Botnet Detection / Local DNS Server → Deployment Mode (in-line, not bypass/mirror)
Also remember that DNS Proxy and DNS Transparent Proxy cannot be enabled at the same time.
I hope this case helps other engineers working with Sangfor NSF. Feel free to share your experience with SOC alerts and policy coverage in the comments.
#Sangfor #SangforNSF #NGAF #SOC #NetworkSecurity #BotnetDetection #TechnicalSupport #Troubleshooting

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

Humayun Ahmed Lv4  Posted 2026-Oct-21 14:29
  
Thanks to share!
AR Lv3  Posted 2026-Oct-21 18:15
  

Thanks for sharing!
Newbie380273 Lv1  Posted 2026-Oct-21 19:15
  

Excellent breakdown George! This is one of the most misunderstood alerts in Sangfor NGAF - many customers panic when they see 224 pending issues in SOC.

As you explained, these are NOT active attacks, but advisory findings from risk assessment engine. Your two root causes are exactly what we see in field:

1. 223 x Server Protection (223) "No network security policy" - This happens when customer has many internal servers but only created security policy for internet -> internal. They forget internal -> internal or internal -> external policies. So NGAF sees traffic to those objects but no IPS/WAF inspection applied. Your solution of creating IP Group "Flagged-Server-IPs" and applying one policy for Server Scenario is best practice instead of creating 223 individual policies.

2. DNS proxy issue - Internal DNS exists but "Local DNS Server Exists" not enabled in Botnet Detection, so DNS redirection for malicious URLs is not active. Many engineers miss this because they think DNS Proxy and Transparent Proxy cannot be enabled together - as you noted in Key Takeaway, they cannot.

We also add one more check: After applying policy, go to SOC > Potential Threats and clear historical items manually if they still show after policy push. Sometimes engine needs 1-2 hours to re-scan and clear automatically.

Your final note is very important: SOC Potential Threat is for closing policy coverage gaps, not proof of compromise. Grouping flagged objects into one IP group is much faster.

Thanks for sharing detailed steps with both Network Coverage + Botnet Detection config. Very helpful for NGAF SOC troubleshooting!

#SangforNGAF #SOC #PendingIssues #NetworkSecurity #BotnetDetection
Newbie006434 Lv2  Posted 2026-Oct-22 00:05
  

Thanks for this detailed case, George. Excellent clarification that these SOC alerts are advisory risk findings, not actual compromise. Many customers get confused with 224 pending alerts in SOC Operations. Your root cause breakdown for "Network Object not configured security policy" and the Botnet Detection DNS proxy fix is very clear. The resolution steps for Flagged IPs grouping and enabling DNS Exists is a practical guide. Appreciated!
Newbie380273 Lv1  Posted 2026-Oct-22 01:00
  

Excellent analysis George! This is very common case on NSF3100A v8.0.95 where customer sees 224 pending issues in SOC and thinks network is compromised.

Your Root Cause is perfect - These 2 types of alerts are advisory from risk assessment engine, not real attack:

1. 223 x Server Protection "No network security policy" - Means 223 internal objects have no IPS/WAF/Content inspection applied. Usually happens when only WAN->LAN policies are created but no LAN->LAN or LAN->WAN coverage for internal servers. Your idea to group all 223 IPs into one IP Group "Flagged-Server-IPs" and create single Server Scenario policy is much better than creating 223 separate policies.

2. 1 x Improper Configurations "DNS proxy server is detected" - Customer has internal DNS but Botnet Detection > Local DNS Server Exists is disabled, so DNS redirection for Botnet C&C domain lookup is not working and infected host cannot be identified.

Your Resolution Step 5 is key: In Protection enable IPS + WAF with default template + Deny, and in Detection and Response enable Botnet Detection with Local DNS Server Exists = Yes + put internal DNS proxy IP. Many engineers miss this and keep Transparent Proxy and DNS Proxy confusion.

Key Takeaway you mentioned is gold - Also remember that DNS Proxy and Transparent Proxy cannot be enabled at same time (in-line, not bypass mirror). That's why botnet DNS redirection fails.

After policy save, it takes 30-60 mins for SOC > Pending Issues to auto-clear after re-scan. Thanks for sharing clear troubleshooting path for SOC Potential Threats = policy coverage gap, not proof of compromise!