SOC alerts troubleshooting and root cause analysis

Hello Sangfor Community,

I am George Fady, Technical Support Engineer, and I would like to share a practical troubleshooting case related to SOC “Pending Issues” alerts on Sangfor NSF/NGAF.

Problem Description

A customer running an NSF3100A (v8.0.95) reported SOC alerts and asked whether their network was at risk. There was no service interruption. The SOC > Security Operations page showed 224 pending issues:

• Server Protection (223): “The network object (X.X.X.X) has not been configured security policy”
  
  
• Improper Configurations (1): “DNS proxy server is detected in the internal network, DNS redirection of malicious URLs is not enabled”
  
  

These alerts are advisory findings from the risk assessment engine, not an attack or breach.

Root Cause

• 223 network objects had no Network Security Policy applied, so traffic to them was not being inspected by IPS, WAF or Content Security.
  
  
• An internal DNS proxy existed, but Botnet Detection’s “Local DNS Server Exists” option was not enabled, so malicious domain lookups were not redirected and the real infected endpoint could not be identified.
  
  

Resolution Steps

• Go to Objects → Network Objects and create an IP Group (e.g. “Flagged-Server-IPs”) containing the flagged IPs.
  
  
• Go to Policies → Network Security → Policies → Add → Policy for Server Scenario.
  
  
• Set the source zone to the external zone, and the destination zone and address to the internal zone and the IP group.
  
  
• In the Protection step, enable Intrusion Prevention and Web App Firewall with the default templates, and set the action to Deny.
  
  
• In the Detection and Response step, enable Botnet Detection, set Local DNS Server Exists to Yes, and enter the internal DNS proxy IP.
  
  
• Save the policy, then confirm in SOC → Pending Issues that the alerts are cleared.
  
  

Key Takeaway

SOC “Potential Threat” items are recommendations to close policy coverage gaps, not proof of compromise. Grouping the flagged objects into one IP group is much faster than adding policies one by one.

When troubleshooting SOC pending issues, check:
Alert Type → Network Object Coverage → Security Policy Template → Botnet Detection / Local DNS Server → Deployment Mode (in-line, not bypass/mirror)

Also remember that DNS Proxy and DNS Transparent Proxy cannot be enabled at the same time.

I hope this case helps other engineers working with Sangfor NSF. Feel free to share your experience with SOC alerts and policy coverage in the comments.

#Sangfor #SangforNSF #NGAF #SOC #NetworkSecurity #BotnetDetection #TechnicalSupport #Troubleshooting

Thanks to share!