Anyone else seeing this FP?

[Ken Stieers]

Getting a stack of DFC Threat Detected for an ip...

205[.]185[.]216[.]42

Its a CDN in Texas... 

Talos says it's bad... but its resolving to things like dl.delivery.mp.microsoft.com, etc.

[Troja007]

Hello @Ken Stieers,
talos is already investigating the issue. Should be fixed soon.
Greetings,
Thorsten

[dotran]

It's been 2 hours now since our system picked it up from AMP and Firepower.   Is this false positive or for real?   

[brmcmaho · Accepted solution]

Looks like a false positive, and should be fixed now.

[soup_dragon]

Thanks for posting, starting to consider isolating so pleased you posted this as when looking into the detail didn’t stack up.