Inquiry on Firewall Alert for Desktops with Atera Agent Connecting to a Specific URL

m.alotaibi

Hello Community,

I hope this message finds everyone well. I am reaching out to seek insights and clarifications regarding an issue we've encountered with our firewall and the Atera Agent installed on some of our desktops.

Recently, we observed firewall alerts indicating that these desktops attempt to connect to the following URL: https://packagesstore.blob.core.windows.net/installers/Fabric/MSI/1.8.6.7/Setup.msi. Given the nature of the alert and the URL's structure, which at first glance could raise suspicions of being potentially malicious, I am trying to understand the source and legitimacy of these connection attempts.

Specifically, I am looking to determine whether the Atera Agent itself is initiating these requests, possibly as part of a patch upgrade process, or if there is another explanation. Understanding the intent behind these requests is crucial for us to decide whether to allow these connections through our firewall.

Additionally, I would appreciate any insights into why Atera would use this particular URL for its operations. It is essential for us to ensure that any external connections made by our network devices are secure and free from potential threats.

If anyone has experienced similar alerts or has knowledge about the Atera Agent's behavior in this context, your input would be greatly appreciated. Insights into how Atera manages its patch upgrades and the use of external URLs for these processes would also be valuable.

Thank you in advance for your assistance and for sharing your experiences. Your support in helping us navigate this issue is much appreciated.

Sarah_from_Atera

Hey @m.alotaibi , Sarah from Atera here.

I can see that you already opened a support ticket with us, but I also wanted to let you know here:

The server you mentioned is one of our mandatory servers that need to be whitelisted in order for Atera to work, that server contains the files for the Atera agent.

If you need further assistance, please reply to the ticket.