Windows server 2022 Eset IDS EsetIpBlacklist.B multiple events

[JAVE 0]

We noticed dozent of events every daily, majority are EsetIpBlacklist.B some are EsetIpBlacklist.A. Port 443 needs to be open, using WS2022 patched up2date, with ESET Server Security 11.0.12012.0 and ESET Management Agent 11.4.1107.0. How to solve this issue? Logs are getting filled only with this server reports.

Thank you.

 

Process name

System

Rule name

 

Rule ID

 

Hash

 

Source address

172.169.206.50

Source port

36730

Target address

192.168.2.106

Target port

443

Inbound Communication

yes

Protocol

TCP

Action

Blocked

User

 

Occurrences per minute

1

[Marcos 5,306]

The server is exposed to the Internet so it's normal that it's targeted by attacks.

As for the mentioned IP address, according to https://ipthreat.net/ip/172.169.206.50?page=0:

Are you running a web server there since port 443 is being attacked?

[JAVE 0]

Yes IIS i running basic web server, only 443 is opened for https, nothing else. Should i ignore this?

 

[Marcos 5,306]

I assume you could avoid logging these attacks by creating 2 IDS exceptions, one for EsetIpBlacklist.A and the other for EsetIpBlacklist.B detection that would have logging disabled: