topic Re: BrightCloud missing the Plot! in General Topics

BrightCloud missing the Plot!

u7285 — Wed, 17 Aug 2011 11:47:20 GMT

Hi Guys and Gals

I see there is already multiple threads about mis-classification on URL categories! I am now pleading with Palo Alto to address this issue with BrightCloud!

To reduce the none business related websites we started blocking the "society" category..... Now we are being flooded with incidents where busines related sites are being blocked..... Sites like BMW.co.za is classified as society but bmw.com is correctly classified!!! Same goes for all other motor vehicle related sites!!! How can they mis this? It seems that if Brightcloud uses the society category as default??

We have been getting arount the problem by adding sites to the allow list and creating custom categories, but this is becoming an administrative hell. We have also reported each URL with Brightcloud, but with amount of url's that we sending we are at the point where Brightcloud will need to put us on their payroll!! - hehehe

Please advise if someone has the same problem and if Brightcloud will address the problem?

Re: BrightCloud missing the Plot!

dyang — Wed, 17 Aug 2011 14:27:59 GMT

Hello,

Thanks for your patience and feedback regarding mis-categorized URLs. In terms of submitting bulk requests to BrightCloud for re-classification, you can always use the email alias dbchange@brightcloud.com for submission. Alternatively, you can also open a support case with Palo Alto Networks, and we can push BrightCloud to re-evaluate the URLs in question. I definitely agree that bmw.com should have the same categorization as bmw.co.za!

Again, thanks for your patience and your assistance in maintaining the quality of the URL filtering database!

Cheers,

Doris

Re: BrightCloud missing the Plot!

scanlab.rgr — Thu, 18 Aug 2011 10:40:51 GMT

Hello,

we have the same problem.

Our users need many Laser related sites. Most of them are mis-categorized.

I agree with you Brightcloud uses the “society” category as default.

In the past we used McAfee Web Gateway formerly Webwasher. The Webwasher URL filter database was much better.

Maybe PaloAlto should think about to change the database vendor…

Regards,

Rainer

Re: BrightCloud missing the Plot!

Laforgepaul — Thu, 18 Aug 2011 15:24:16 GMT

This is a big issue for us as well. Their url categories are very unreliable and we have had many issues. When we talked with Brightcloud they indicated that the categorisation is automated and sites do get miss categorized. (even double categorized) Often when we request to recategorise a url, it's often changed back by the automated system.

Also we've had issues where users are going to their site and changing URL categories to bypass our restrictions and gain access. This has been possible with Brightcloud because of the self serve public Portal to re-categorize URLs.

Re: BrightCloud missing the Plot!

dyang — Thu, 18 Aug 2011 20:29:47 GMT

Hi everyone,

BrightCloud uses both automated and manual processes to categorize URLs, and is always making improvements in their process to reduce the number of mis-categorized URLs. Though BrightCloud allows anyone to request a re-categorization via their website, there are checks in place to prevent abuse of this service, such as intentionally submitting an incorrect category. If you have any examples of this happening, please open a ticket with Palo Alto Networks Support so that we can address this with BrightCloud.

As always, we welcome any feedback regarding our products!

Thanks,

Doris

Re: BrightCloud missing the Plot!

u7285 — Fri, 19 Aug 2011 07:02:13 GMT

Hi Doris

Thank you for your replies.... We understand the processes Brightcloud uses, but still we cannot afford the time\manpower to build their database for them. I Think it would have been valid if all Categorization engines was having the same major issues then yes... we have no other choice, but there are better engines out there and if Brightcloud is going to continue to be a sub-standard engine then it will most definitely have a negative impact on Palo Alto sales. At this we have halted all Palo Alto Sales as we simply cannot handle the extra work created by the Bright Cloud engine.... Don't get me wrong here... Palo Alto is a GREAT product, It simply need to focus on fixing the URL categorization engine. Enjoy!

Re: BrightCloud missing the Plot!

keklund — Mon, 22 Aug 2011 19:51:05 GMT

We've also seen more and more of this - 'society' is essentially a worthless category. Every new proxy site seems to fall there, and is allowed until the app detection catches up.

We need to have 'society' open because we are an educational institution.

BrightCloud was touted as an improvement over SurfControl, and it was at the beginning. Now I constantly have to answer questions on why certain sites are blocked and certain sites are allowed.

We bought this product specifically because we wanted to stop playing whack-a-mole :smileyangry:

Re: BrightCloud missing the Plot!

lardsa — Wed, 31 Aug 2011 11:40:51 GMT

I agree, Brightcloud must improve their system, I send a minimum of 4 URLs per week and I noticed some URLs are back to their old/wrong category after some time.

Re: BrightCloud missing the Plot!

dmarion — Wed, 31 Aug 2011 13:34:41 GMT

I'm planning on rolling out some url filtering for security purposes.

My goal is to give users a continue page when they navigate to a URL that falls into one of the following categories; bot-nets, confirmed-spam-sources, spam-urls, malware-sites, spyware-and-adware, unconfirmed-spam-sources, or fishing-and-other-fraud.

I'm from the edu space, so I can't block everything, but I was wondering if anyone has had success in filtering out the bad url's? I see posts like this and I start second guessing myself.

Re: BrightCloud missing the Plot!

Laforgepaul — Wed, 31 Aug 2011 15:52:58 GMT

I can say that this part works very well on our PAN devices. We do a hard block on malicious URLs and custom continue pages on categories that are against our policies. We haven't ran into many issues with this feature.

Re: BrightCloud missing the Plot!

u7285 — Thu, 01 Sep 2011 05:36:34 GMT

I agree with Laforgepaul. Just make sure your corporate policies are in place and that they are enforced. Otherwise your users will still run riot and you will not be able to take action against them.

Why is Palo Alto so quite regarding the subject?

Re: BrightCloud missing the Plot!

dyang — Thu, 01 Sep 2011 06:41:28 GMT

I'm right here, guys; never far away. Just wanted others to offer their own experiences, regardless of what they may be, as real-life deployments are far more valuable than any examples I can give.

As I mentioned in a previous post, should there be quality issues with the BrightCloud database, please open a ticket with our Support team so that we can engage appropriately with BrightCloud.

Thanks,

Doris

Re: BrightCloud missing the Plot!

migration — Thu, 01 Sep 2011 18:58:20 GMT

We have similar issue, instead of "society" site we’re getting legit websites categorized as “adult and pornography”, we have submitted several request to Bright Cloud for re-categorization so far nothing has changed, I do miss Websense...

Re: BrightCloud missing the Plot!

dyang — Thu, 01 Sep 2011 20:49:35 GMT

acary,

Could you message me with the URLs in question? I'd like to look into this with BrightCloud.

Thanks,

Doris

Re: BrightCloud missing the Plot!

u7285 — Fri, 02 Sep 2011 07:01:59 GMT

Hi Doris

I trust you doing well?

Here is a good example why Brightcloud is missing the plot.......

UmeNow vows to kill Facebook, dismisses Google+

http://www.zdnet.com/blog/facebook/umenow-vows-to-kill-facebook-dismisses-google-/3209?tag=mantle_skin;content

UmeNow.com is classified as "society" on Brightcloud, A well know Social Networking site miss-classified.....

Do I need to say more

Regards

Kobus

Re: BrightCloud missing the Plot!

migration — Fri, 02 Sep 2011 13:12:13 GMT

thanks

Re: BrightCloud missing the Plot!

migration — Fri, 02 Sep 2011 13:19:11 GMT

Doris,

Please review this samples, I do have more if needed

www.putt.com/newadmin/uploads/P_EtradeBaby_1.jpg

Websense Category: Sport

BrightCloud Category: adult-and-pornography

________________________________________________

www.ashlandfoundrymachineworks.com/

Websense Category: Business and Economy

BrightCloud Category: adult-and-pornography

_______________________________________________

http://www.lewpen.com/

Websense Category: Games

BrightCloud Category: adult-and-pornography

http://www.science-portal.org/

Websense Category: Information Technology

BrightCloud Category: adult-and-pornography

thanks

Re: BrightCloud missing the Plot!

dyang — Fri, 02 Sep 2011 18:24:58 GMT

Thanks, Kobus. I will bring this up with BrightCloud directly.

--Doris