PAN only takes the first category of an URL from Brightcloud

[michael_schumak]

Here is an example:

www.aetna.com is rated on the website of Brightcloud as "Business and Economy" and "Health and Medicine".

"test url www.aetna.com" results in a  "Business and Economy", which could cause some legal issues when traffic to "Health and Medicine" should not be performed due to privacy reasons.

Are there any plans to change that in the near future?

Regards,

Mike

[gafrol]

Hi Michael,

this has been discussed before

https://live.paloaltonetworks.com/message/7118

What is your suggestion ? How would you like to see this implemented ?

rgds Roland

[mikand]

Isnt this just a cli bug (which of course should be taken care of but still)?

I mean what happens if you setup a rule that block access to "Health and Medicine", are you still able to access www.aetna.com ?

[michael_schumak]

I have reviewed other discussions as well after I have written the posting. I haven't tested the proposal with creating custom categories so far.

The more I think about it, the less I have a solution for it:

What should be done for a URL like that: "www.nudetravel.com"? It is fist categorized as "travel", then as "nudity" and lastly as "porn".

A company which want to prevent its emploees from porn etc. would have to make custom categories for every questionable website? That can't be the solution.

Maybe all categories should be taken into account?

[kalavi]

Hi,

PAN usually pulls out single category from Brightcloud server, if you feel like any website is marked under wrong category please open a case with support so that a request can be filed. The category will be verified and will be fixed in the next URL db release.

Between, you can check the URL category from the following command on CLI:

PAN> test url <website>

Thanks,

Khubaib

[mikand]

Can this be fixed or is this a hardware limit or such in PAN?

Because I find it too a bit odd that only a single category would match.

The www.nudetravel.com is a great example. If this url would be categoriesed as both "nudity" and "traveling" and I setup a security rule to block access to travelsites I expect this rule to get a hit for "www.nudetravel.com" without me having to manually create my own url-category database (because thats the whole point of buying an url-category db license to not having to maintain your own url-db except for a few "false positives" or "unknown" sites). The same if I setup a security rule to block "nudity", I expect that the same url would get a match here too.

[Art]

Hello,

   I must first state I am new to the PAN's and setting up URL filtering to replace our existing proxy based web filtering solution.

   I would/did expect that a site categorized as Nudity and Travel would be blocked if I have a block rule to block nudity.  ie I hope that the PAN evaluates for multiple categories and that Blocks win out.over allows - and then I would build my rules accordingly.

Thanks

Art

[bbraun]

Has Palo Alto followed up on this?  The last discussion was 8 months ago. Hard to believe that other url filtering companies can do this for years now.

Thanks.

Brent