topic URL Profile Known Bad Categories in General Topics

URL Profile Known Bad Categories

Claw4609 — Tue, 20 Jun 2023 20:00:37 GMT

What are the known bad url categories that palo checks is blocked? We currently block all the categories in this document but AI-Ops still flags it. Is there a way to see specifically what its failing?

Malicious URL Categories (paloaltonetworks.com)

Re: URL Profile Known Bad Categories

OtakarKlier — Tue, 20 Jun 2023 21:29:49 GMT

Hello,

If you correlate the traffic in the Unified logs, it should tell you why the traffic was blocked etc.

Regards,

Re: URL Profile Known Bad Categories

Claw4609 — Wed, 21 Jun 2023 12:07:49 GMT

Im more wondering why AI-Ops doesnt think we're blocking known bad url categories. Not necessarily anything in the firewall logs or why something is getting blocked or allowed.

Re: URL Profile Known Bad Categories

BPry — Wed, 21 Jun 2023 13:07:30 GMT

@Claw4609,

The AIOps dashboard is ... less than intuitive. If you go into the 'Alerts' section on the dashboard and click on the hyperlink of the alert it'll bring you into the actual alert details. This will list out the 'Evidence' at the bottom that will have the actual URL Filtering profile name and list the categories that the profile doesn't have set to block.