Compromised host FMC

[Steven Williams]

I have users trying to access a host that is showing up in FMC events with "red" computer icon which means compromised. The action is allowed in the event log. I have also added this host to bypass the sfr and i still the client getting tcp resets to this host from splunk. How do I fix this?

[Abheesh Kumar]

How you bypass the client....
Did you whitelist the IP or excluded the IP from the sfr acl.

[Steven Williams]

sfr acl. but I still see it on the fmc logs.