Traffic log Category: command-and-control

[Marco.Dermitzakis]

hello,

can someone please explain to me why I observe logs from an external ip of Type: TRAFFIC, Category: command-and-control 

Action: drop.
Shouldn't the category trigger for connections made from inside out ?
Also, why it generates Traffic logs and not Threat logs?

Thank you 

[OtakarKlier]

Hello,

Review your inbound policies and see what inspections you have on the traffic. Typically I dont enable URL filtering on inbound traffic.

Regards,