Issues Creating Custom App

[DuggiFresh]

In order to allow Updates to OneDrive im trying to create a custom application. (since I'm blocking PE) as it is detected as web-browsing. It does not detect that ms one drive premade application. 

I created a custom signature with the Client hello sni (oneclient.sfx.ms), as I found that from the packet capture. My issue is that it works for some of the traffic but other traffic it is not recognizing the app as OneDrive. 

What could be going wrong?

[Raido_Rattameister]

If you go to Monitor > Data Filtering and get destination IP where file download was attempted from and then go to Monitor > URL Filtering and use the same destination IP as filter what URL do you see in logs?

[DuggiFresh]

I see oneclient.sfx.ms/

[DuggiFresh]

Any more insights into this?

[Raido_Rattameister]

Add new URL category 

Objects > Custom Objects > URL Category

add 2 entries

*.oneclient.sfx.ms/

oneclient.sfx.ms/

Create security policy above default outgoing policy to permit traffic to newly created URL category and assign file blocking profile to the rule that does not block download of executable files.

[DuggiFresh]

That still is not working and its only for some users. 

[Raido_Rattameister]

You can add those specific users into "Source User" field to permit rule for those users only.