File Blocking rule logic

[nsendelbac]

The following KB article states that the File Blocking rulebase is not top-down but based on action precedence. The article fails to mention anything on the function of the application column with regard to processing logic:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGeCAK

If for instance, I have a security rule that allows any application, and in the attached File Blocking profile I have a "Block Webmail EXE" rule that blocks on .exe file types, and has Gmail configured in the application column.

Next I have a "EXE Alert" file blocking rule that alerts on .exe file types and has "Any" application specified.

According to the above article, if a file type matches multiple File Blocking rules, the rule with the highest precedence action will win (block in this case). But what about the application column? If the application being used is web browsing and the "Block Webmail EXE" rule is only configured for Gmail, would it still block the file? Or would it recognize that this session is Web-Browsing, not Gmail, and match instead on the other "EXE Alert" rule?

[BPry · Accepted solution]

@nsendelbac ,

The application is taken into account when analysing the traffic. So if you block EXEs specifically for Gmail and set all others to alert, it will only block EXEs from any traffic identified as Gmail traffic. 

The only thing to keep in account here is that the traffic needs to be identified correctly for that policy to function correctly. If you aren't decrypting traffic your Gmail traffic might not always be getting identified correctly.