topic Threat ID 35823 is exempted then also it is blocking the traffic in General Topics

Threat ID 35823 is exempted then also it is blocking the traffic

OsamaKhan — Thu, 15 Jul 2021 13:53:59 GMT

Hi,

HTTP SQL Injection Attempt threat id: 35823. we have exempted this threat id but it is blocking the traffic.

on the traffic log, the session end reason is showing threat and in the threat log, it is showing reset-both.

Want to know why it is still blocking and how can I troubleshoot this further.

Re: Threat ID 35823 is exempted then also it is blocking the traffic

SutareMayur — Fri, 16 Jul 2021 14:04:11 GMT

Hi @OsamaKhan

I would verify the profile attached on the security policy and check if it is the same where the exemption to above threat id is given. If desired profile is mapped on the security policy, make sure if enable option is checked for above threat id under exception tab.

Hope it helps!