To configure Suspicious Connection Service to block/log the C&C IP address:

1. On the Apex One web console, go to Agents > Agent Management.
2. Navigate to Settings and click Additional Service Settings.
3. Under Suspicious Connection Service, tick Windows desktops or Windows Server platforms.

   

   ^{Click the image to enlarge.}

4. Go to Settings and click Suspicious Connection Settings.
5. Tick Detect network connections made to addresses in the Global C&C IP list. For Apex One or newer, then select Log only or Block from the dropdown options.

   

   ^{Click the image to enlarge.}

6. Click Save.
7. Test the connection to the C&C IP address. In Block mode, the alert will pop up and the log can be found under Suspicious Connection.