topic Re: Quality of Brightcloud URL categorisation or lack of. in General Topics

Quality of Brightcloud URL categorisation or lack of.

robert.b — Tue, 26 Oct 2010 14:08:52 GMT

Hello

Has anyone else found that there are a large number of websites being classified as Job Search when they are blatantly not? We are finding this to be the case and in fact are generally finding the classifications to be a bit hit and miss in places. Our previous URL filtering solution used the Smartfilter database and we never really had any problems with that.

Any opinions??

Thanks

Re: Quality of Brightcloud URL categorisation or lack of.

a.klingauf — Tue, 26 Oct 2010 18:36:47 GMT

Hi,

yes we had the same problem. Specially german websites are often categorized as "job search". At first we tried out to send the "false positives" to brightcloud to recategorize this, but this wasn't so funny. Finally we decided to disable brightcloud !!

greeds

Arne

Re: Quality of Brightcloud URL categorisation or lack of.

fredallee — Tue, 26 Oct 2010 19:43:33 GMT

Thanks for your comments. We have indeed brought up this issue with BrightCloud and have asked them to review and make adjustments to their automated classification engine. As they work on this, please don't stop submitting miscategorization issues like this as it will help them to continue to train their engine to make it more accurate. If it makes it any easier, instead of submitting them one by one to BrightCloud, you can simply email support with a spreadsheet of URLs. Then, we can get them to BrightCloud for immediate re-categorization.

Thanks,

Alfred

Re: Quality of Brightcloud URL categorisation or lack of.

robert.b — Wed, 27 Oct 2010 10:04:35 GMT

Arne

So what are you using for URL classification? Or are you not controlling access based on the URL anymore?

Thanks

Robert

Re: Quality of Brightcloud URL categorisation or lack of.

a.klingauf — Wed, 27 Oct 2010 13:09:04 GMT

I don't wanna advertise other products in a PaloAlto forum....

But now we use another product for this matter. We take a "cloud based proxyserver" with dynamic URL classification and put it infront of the PAN.

Best Regards,

Arne

Re: Quality of Brightcloud URL categorisation or lack of.

djbisbey — Thu, 28 Oct 2010 07:36:49 GMT

Yep got to agree, not actually with the 'job search' but we are ballet school in the UK and we find so many of the sites the students go to are classified as 'not-resolved' which is really unhelpful, as we did block the 'not resolved' to protect the students from unknown sites etc.

Furthermore I submitted a URL definiation change, we also blocked uncatergorized and a banking site we were using kept being blocked, so I submitted the URL for reclassifcation as clearly its not uncatergorized its an internet banking site, this is what they replied with...

Hello again -

We have reviewed ibb.aibgb1.co.uk and determined that it does not need to be changed at this time based on BrightCloud’s classification criteria.

It is currently classified as Uncategorized in the BrightCloud Service and available in Database version 3.440.

You can read our Database Change FAQs for more information on the most common reasons why your suggestion may not have been implemented.

Thanks again for your suggestion!

As you can see they kept it as is, what is the point of submitting a URL when I actually know that it should be under financial and not classified as 'uncatergorzied'.

Smartfilter was so much better on our previous product and accurate...after all we pay for the license and if brightcloud are not prepared to alter their policy then maybe Palo need to look elsewhere for a URL filtering solution...

Darren

Re: Quality of Brightcloud URL categorisation or lack of.

James — Thu, 28 Oct 2010 10:18:30 GMT

Hi Darren,

I would like to try and help, 1st of all generically - then with your items below:

Please - if you feel a submission to Brightcloud did not get the correct attention, log a call directly with us (Palo Alto Networks). We will help you to get the desired outcome.

We expect all our customers to get good service - so we'll do what we can to resolve this. Please log with our support.

The specific domain you mention ibb.aibgb1.co.uk - I could not get to this. Maybe it is Unknown, or do you get there via logging into somthing else?

Looks like Allied Irish, I guess?

'Not-Resolved' - this is a technical issue and should be logged with Palo Alto Support. This means you are not getting an answer from the Brightcloud Database within 5 seconds - so we'll need to check with you why that is. We also have some code enhancements coming in this area in 3.1.6 - due to be released in November. However, do not wait for that - I am sure we can help you now.

Thanks

James

Re: Quality of Brightcloud URL categorisation or lack of.

djbisbey — Thu, 28 Oct 2010 10:55:53 GMT

James,

you are quite right it is from Allied Irish and actually went through from a link within their site, but once the user clicked on the link it did nothing, on investigation it was down to the item being categorized as 'not-resolved' so once I allowed the user to view not resolved category they could click through no problem.

I have raised a case 00023838.

I have now checked our logs and find that theses sites (just some examples) are being categorized as 'not-resolved' so I have attached an xls export to give some idea of the issues.

Thanks

Darren

Re: Quality of Brightcloud URL categorisation or lack of.

James — Thu, 28 Oct 2010 11:00:37 GMT

Hi Darren,

Well, good and bad news

Not good that you have so many not-resolved sites. But good news you have logged a case - I am sure we'll get you to a resolution soon!

Thanks

James

Re: Quality of Brightcloud URL categorisation or lack of.

dread — Thu, 28 Oct 2010 15:42:51 GMT

Hi Darren, I have had good luck getting Brightcloud to recategorize URLs by doing a URL lookup at http://www.brightcloud.com/ and then using the Suggest a new Category link and plugging in Palo Alto Networks for the Integration field. Brightcloud usually responds within 1 or 2 business days with a change (not always the category I suggest but usually an acceptable one). However, I haven't had to do this with many foreign websites so your mileage may vary.

Also, if you are getting a lot of not-resolved definitely contact support. We were having major issues with URL-filtering (we block unknown and not-resolved) and support helped us get the issue fixed.

Dave

Re: Quality of Brightcloud URL categorisation or lack of.

rodrigum — Thu, 28 Oct 2010 16:26:27 GMT

We have had precision issues with Brightcloud as well; I brought it up to our SE.

In general I would say accuracy is lacking.

Re: Quality of Brightcloud URL categorisation or lack of.

fredallee — Thu, 28 Oct 2010 21:28:50 GMT

Regarding the not-resolved issues, there's a known issue in 3.1 code surrounding not-resolved URLs. We anticipate a fix for the issue in 3.1.6. If you are seeing high numbers of not-resolved URLs, please contact support.

Re: Quality of Brightcloud URL categorisation or lack of.

djbisbey — Fri, 29 Oct 2010 07:25:38 GMT

well, I have a ticket with them. Lets see if they can put this to bed...

as yet nothing back from them, sent our support logfile over to them yesterday afternoon.

Re: Quality of Brightcloud URL categorisation or lack of.

James — Mon, 22 Nov 2010 14:31:06 GMT

In PANOS 3.1.6, we are getting good feedback with regards to fixing the error in getting unknown categories returned as "Not-Resolved".

In terms of the database in accuracies with regards to job-search category. Brightcloud are finalising the fine tuning of their engine in this area. The process and reclassification should be complete by the end of November 2010.

Best Regards

James

Re: Quality of Brightcloud URL categorisation or lack of.

CWillms — Wed, 24 Nov 2010 20:31:00 GMT

Coming from another categorization db vendor that was very good I am finding BrightCloud far more inaccurate. Our problem on several occasions was sites being categorized as Religion (which we block) and yet the BrightCloud lookup was categorized correctly. Our PA device was wrong! So what am I supposed to do then?

Re: Quality of Brightcloud URL categorisation or lack of.

bpappas — Mon, 29 Nov 2010 20:21:12 GMT

I am assuming that you have already verified that you are running the 3.1.6 PA software and the most up to date Brightcloud database (3491 is the latest version as of Nov 29, 2010).

If you are completely up to date on software and URL filtering database versions and still seeing this issue, you should open a case with PA technical support to resolve any issues where the database version on the firewall and the Brightcloud firewall are the same, but the query result is different.

Re: Quality of Brightcloud URL categorisation or lack of.

migration — Tue, 30 Nov 2010 16:55:33 GMT

I have to say that the Brightcloud URL Categorization needs quite some work. I have also experienced many categorization errors. Even when we re-categorizing these sites and they change, I have had a few that have gone back to the original category.

I think in my opinion it is time to use another vendor for your URL filtering, as the Brightcloud URL Filtering is quite weak in comparison to others out there. Or Brightcloud really needs to look at their competitors categories and the accuracy.

Re: Quality of Brightcloud URL categorisation or lack of.

CWillms — Fri, 03 Dec 2010 14:18:28 GMT

Upgrade to 3.1.6 scheduled for this weekend!

Thanks for the advice.

Re: Quality of Brightcloud URL categorisation or lack of.

djbisbey — Thu, 13 Jan 2011 15:02:14 GMT

Today, all of a sudden (3.1.6) users are hitting the not-resolved url issue, then these sites were working perfectly yesterday.

I am not sure if I should raise a ticket for this or not?

Wondering if its brightcloud or palo?

Thx

Darren

Re: Quality of Brightcloud URL categorisation or lack of.

nrice — Thu, 13 Jan 2011 18:08:59 GMT

Hi Darren,

Please open a case. There are no known issues with BrightCloud at this time.