Customer is requesting detailed ATP sky threat assessment report with list of C&C server IP's and the host trying to access those IP's.

Default report from SkyATP provides only C&C server counts and countries list.

The Default Report that which customer receives contains a summary of the C&C Server Connections.

• There is no direct way to achieve this, and there are no custom reports that we can generate that could give us the complete connection details with SIP and DIP.
• A summary of the connection details are sent to the Cloud and the same is available on the existing reports.
• We can configure logging for recording SESSION-INIT and SESSION-CLOSE for local logging of the SRX.
• The same can be written to a local file or forwarded to an external log server for filtering based on the SIP and DIP.