AnsweredAssumed Answered

Symantec IRC 6667 from Qualys Server

Question asked by Jim Lewis on Jan 2, 2019
Latest reply on Jan 3, 2019 by derekv

I'm unable to understand some data from an MSSP, Symantec. I'm recieving a continual report about IRC Activity on a network, port 6666/6667. The source ip in this report is a Qualys server. I'm unable to tell if this is saying the Qualys is using 6666/6667 in its activity or, maybe, if Qualys is detecting IRC activity (and that its a misnomer in the report that qualys source ip is using irc.)

Outcomes