topic Re: Hotmail session end Reason "threat" in Advanced Threat Prevention Discussions

Hotmail session end Reason "threat"

wrollins — Tue, 06 Nov 2018 23:48:34 GMT

im trying to allow hotmail. i have created a policy to allow hotmail. when going to the web site "mail.live.com" action is "allowed" however the session is ended because "threat" i cant quite find why and/or where hotmail application is being catagorized as a threat. any help? thanks

Re: Hotmail session end Reason "threat"

OtakarKlier — Thu, 08 Nov 2018 19:46:39 GMT

Hello,

Click on the paper and magnifying glass icon on the far left of the lost. It'll bring up more details and there you should be able to see in the middel as to what it found and why it was blocked.

Hope that helps.

Re: Hotmail session end Reason "threat"

wrollins — Fri, 09 Nov 2018 16:52:29 GMT

we were able to resolve the issue. turns out the USER ID was coming across with only part of the domain name and the policy was set for the full domain name. There for, my traffic was never meeting the criteria for the policy and fell into the explicit deny.

Re: Hotmail session end Reason "threat"

wrollins — Fri, 09 Nov 2018 16:53:55 GMT

That was. thank you!

Re: Hotmail session end Reason "threat"

MaheshCrypto — Fri, 02 Aug 2019 06:09:59 GMT

Hi,

I can not agree with you explanation, since if the user is not matching then it's going the deny rule at the end is fine. But here it's identified as a 'threat'. So should be blocked by URL Filtering. But if it is also not.. That's the issue. I'm also facing same issue. Traffic is dentified as a threat in traffic log. But URL Filtering action is allowed.