Wrong classified URL

[HeinzP]

Hi,

Can someone explain what the malware base DB is?

Does the MLAV flag indicate that the file was classified as malware by the machine learning engine? If so, how can this classification be overridden or excluded?

Thanks.

[HeinzP]

show url-cloud status:

[TomYoung]

Hi @HeinzP ,

Yes, the MLAV flag indicates the Machine Learning engine.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oM37CAE&lang=en_US%E2%80%A...

Under the Inline Categorization tab you can add a custom URL list for exceptions.  A simple solution is to add the same Allow custom URL list that you use for category exceptions.  In that way, you have 1 custom URL list for all exceptions.

Thanks,

Tom

[HeinzP]

That was my assumption as well. However, the logs only show "N/A" in the inline categorization verdict.

The CLI returns the same result even when a custom URL exception is configured. Also restart of the Gateway does not solve this issue.

[mcanaval]

Hola HeinzP,

¿Estás aplicando SSL Outbound Inspection dentro de tu red?

De no ser así, el NGFW podría no identificar ni clasificar con precisión la categoría de la URL, ya que, sin descifrar el tráfico SSL/TLS, la inspección es limitada y no permite realizar un análisis profundo del contenido.

Como alternativa, te recomiendo crear un URL Category personalizada que incluya el dominio puntual portal.dev.vortexcloud.com o todos los dominios de vortex *.vortexcloud.com y agregarla al perfil de URL Filtering configurado en tu política de acceso, configurando la acción Allow para permitir el acceso.

Si tienes alguna duda adicional, no dudes en comentarla.