Malware category IPS questions and comments

[Tim Zakharov <tzakharov@protonmail.com>]

Hi, since enabling the Malware category in the IPS, I am getting a lot of hits in the logs that seem completely unrelated to Malware.

For example, just this morning between 9:36:58 and 9:36:59, I received 20 hits with the source being my Windows 11 desktop and destination being IPFire, all on port 53.  
The rule is:
IPFire DBL [Malware] Blocked DNS Query
Type:
Potential Corporate Privacy Violation
SID:
406786433

I cannot tell what triggered these hits, but I can tell you I was not doing anything that would trigger Malware on my system.

Is there any way to determine what triggers Malware hits (the originating rule, for example?)

If I go to Customize IPS Rulesets and show the IPFire DBL Malware category, there are only 4 checkboxes:
IPFire DBL [Malware] Blocked DNS Query		IPFire DBL [Malware] Blocked HTTP Request
	IPFire DBL [Malware] Blocked TLS Connection		IPFire DBL [Malware] Blocked QUIC Connection

So at the moment there is no granularity to uncheck a particular rule that might be filling my logs with false positives.

Also, I see no way how I could report this as a false positive because there is no granularity to tell which rule is triggering it.

I considered posting this in the forums, but I saw Michael telling someone else "I would appreciate if you joined our DBL mailing list and share your thoughts there as this support forum is not the right place." so I thought I should post here instead of the forum.

Thanks,
Tim