Daily Palo Alto Networks Reports

[MelLi]

Hi Guys,

I have a question about PA Daily Networks Report.

On the last report we ran, the top five URL categories were the below

web-advertisements 4,582

proxy-avoidance-and-anonymizers 162

unknown 70

malware 65

games 20

Can anyone please help me to understand

Web advertisements as the top URL - does PAN have an explanation for this category?

Unknown - Why/how are URL listed as unknown.

For the Unknown categories, I assume the database doesn't contain the categories users were browsing, but my customer was not quite satisfy with this unknown categories showing in the top five categories.

Thanks.

Cheers,

Mel

[HULK · Accepted solution]

Hello Mel,

You may follow this discussion thread: Re: URL Filtering Category is "Unknown"

By default, any newly registered domain will be "unknown" in PAN-DB until Palo Alto Networks reviews, either manually by the analysis/threat team, or through the crawler (triggered on some event). Once an "unknown" is seen on the Palo Alto Networks servers, it will be put into a prioritized queue for crawling and classification. Once Palo Alto Networks determines a category, it will be included in the next database refresh.

Enable global setting to force dynamic-url lookup:

# set deviceconfig setting url dynamic-url yes

# commit

You may clear the cache with CLI command:

> clear url-cache all

Few related discussions/doc for your reference:

Re: URL resolving to unknown while know on brightcloud

Many 'Unknown' Entries In URL Log

User Web Traffic Categorized as Unknown

Hope this helps.

Thanks

[MelLi]

Hi Hulk,

Thanks for your reply. That helps a lot for understanding this report.

Cheers,

Mel