Adding IOCs to URL Filtering

[eliang]

Hi PAN Live Community,

If I add additional IOCs (URLs/Domains/IPs) to our current active URL Filtering Profile, how do I make those new IOCs take affect?

Besides committing the changes to the added IOCs, do I need to re-apply the this profile to the Security Policy (in the Policies tab?)

The reason I'm asking is because (if memory serves me right) I added the new IOCs to the current URL Filtering Profile, but I was still able to visit the sites I added to be blocked.

[Raido_Rattameister]

URL profiles are added to security policy.

Did you add those bad url's to URL profile blacklist window or you created new custom URL category and added them there?

If second option then did you change this custom URL category action to block inside URL profile?

[eliang]

I simply added new IOCs to the current URL Filtering Profile, which this profile is part of the current active Security Policy.

I just spot checked one of the sites to be blocked and I can still visit it.

[eliang]

Turns out, whover tuned our URL Filtering policy had everything on alert/allow. I used the predefined profile and everything is good.