https://live.paloaltonetworks.com/t5/general-topics/url-risk-rating-discrepancies/m-p/419268#M93770 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/152128">@RVizcarra</a> ,</P><P>Looking at your logs it seems the latest one more than a month old (06/10), while the "Test A site" will give you current category.</P><P>My assumption is that Palo Alto have previously categorized those as high initial, but at some point they have updated it.</P><P>Do you have any fresh logs?</P><P>&nbsp;</P><P>In addition I would strongly suggest you to take a look at this kb - <A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3rCAC" target="_blank">How to Verify URL Categorization: Data Plane and Management Pla... - Knowledge Base - Palo Alto Networks</A></P><P>It will give you some commands that you can use to troubleshoot such discrepancies.</P><P>This one is also good to read - <A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clu3CAC" target="_blank">How to Handle a URL Miscategorization - Knowledge Base - Palo Alto Networks</A></P> Wed, 14 Jul 2021 10:22:42 GMT aleksandar.astardzhiev 2021-07-14T10:22:42Z https://live.paloaltonetworks.com/t5/general-topics/url-risk-rating-discrepancies/m-p/419237#M93766 <P><SPAN>Why the URL category for sync.predictive.com and mail.eventss.com is High Risk in PA firewall but in Test A URL site it is Low Risk?</SPAN></P><P><SPAN>I assume I should follow what is shown on firewall and disregard A Test site for good measure. But what is the cause of the difference?<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="PA.png" style="width: 805px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/35023i7B528BE1FD4DA213/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="PA.png" alt="PA.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Test A.PNG" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/35024iA77DB73C65875933/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Test A.PNG" alt="Test A.PNG" /></span></SPAN></P> Wed, 14 Jul 2021 05:18:34 GMT https://live.paloaltonetworks.com/t5/general-topics/url-risk-rating-discrepancies/m-p/419237#M93766 RVizcarra 2021-07-14T05:18:34Z https://live.paloaltonetworks.com/t5/general-topics/url-risk-rating-discrepancies/m-p/419268#M93770 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/152128">@RVizcarra</a> ,</P><P>Looking at your logs it seems the latest one more than a month old (06/10), while the "Test A site" will give you current category.</P><P>My assumption is that Palo Alto have previously categorized those as high initial, but at some point they have updated it.</P><P>Do you have any fresh logs?</P><P>&nbsp;</P><P>In addition I would strongly suggest you to take a look at this kb - <A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3rCAC" target="_blank">How to Verify URL Categorization: Data Plane and Management Pla... - Knowledge Base - Palo Alto Networks</A></P><P>It will give you some commands that you can use to troubleshoot such discrepancies.</P><P>This one is also good to read - <A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clu3CAC" target="_blank">How to Handle a URL Miscategorization - Knowledge Base - Palo Alto Networks</A></P> Wed, 14 Jul 2021 10:22:42 GMT https://live.paloaltonetworks.com/t5/general-topics/url-risk-rating-discrepancies/m-p/419268#M93770 aleksandar.astardzhiev 2021-07-14T10:22:42Z