Can anyone give me suggestion for how to block only Linkedin Messaging but can access other Linkedin functions.

[CosminM]

Hi @lucydeapple 

First you must decrypt that traffic and to block based on App-ID linkedin-mail. If you don't make decryption, then all LinkedIn traffic it will be labeled as linkedin-base.

If blocking application linkedin-mail is giving to many false-positive then you will need to create custom application or vulnerability signature and to use that custom to block the traffic.

• Create a Custom Application Signature
• Create a Custom Threat Signature
• How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples

Look on a similar post:

Application Shift and How to allow linkedIn but block specific linkedin-posting application