topic Issues Creating Custom App in Custom Signatures

Issues Creating Custom App

DuggiFresh — Fri, 28 Apr 2023 16:50:12 GMT

In order to allow Updates to OneDrive im trying to create a custom application. (since I'm blocking PE) as it is detected as web-browsing. It does not detect that ms one drive premade application.

I created a custom signature with the Client hello sni (oneclient.sfx.ms), as I found that from the packet capture. My issue is that it works for some of the traffic but other traffic it is not recognizing the app as OneDrive.

What could be going wrong?

Re: Issues Creating Custom App

Raido_Rattameister — Fri, 28 Apr 2023 17:33:07 GMT

If you go to Monitor > Data Filtering and get destination IP where file download was attempted from and then go to Monitor > URL Filtering and use the same destination IP as filter what URL do you see in logs?

Re: Issues Creating Custom App

DuggiFresh — Fri, 28 Apr 2023 17:45:06 GMT

I see oneclient.sfx.ms/

Re: Issues Creating Custom App

DuggiFresh — Mon, 01 May 2023 16:17:57 GMT

Any more insights into this?

Re: Issues Creating Custom App

Raido_Rattameister — Mon, 01 May 2023 16:27:17 GMT

Add new URL category

Objects > Custom Objects > URL Category

add 2 entries

*.oneclient.sfx.ms/

oneclient.sfx.ms/

Create security policy above default outgoing policy to permit traffic to newly created URL category and assign file blocking profile to the rule that does not block download of executable files.

Re: Issues Creating Custom App

DuggiFresh — Mon, 01 May 2023 19:42:55 GMT

That still is not working and its only for some users.

Re: Issues Creating Custom App

Raido_Rattameister — Mon, 01 May 2023 20:09:38 GMT

You can add those specific users into "Source User" field to permit rule for those users only.