Hi @roma , "Malicious URLs can be updated or introduced before URL filtering databases have an opportunity to analyze the content; this lag time gives attackers an open period from which they can launch precision attack campaigns on the firewall" The lag time is the time between when a malicious URL is introduced and when the URL filtering database [companies] are able to analyze the content and assign categories to it. PAN-DB updates are not done as part of application and threats or any configurable dynamic update. "PAN-DB does not have daily updates, instead the URL entries are retrieved from the cloud server as needed. The Palo Alto Networks firewall automatically checks for the updates, and system logs are generated every 8 hours indicating if the latest URL-filtering database was downloaded or not." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpMCAS With regard to "risky" URLs, these have not been categorized yet. They are recommended to be blocked with the "unknown" category. https://docs.paloaltonetworks.com/best-practices/10-0/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles.html Blocking unknown may occasionally cause valid web sites to be blocked, but exceptions can be made. Finally, The URL Filtering subscription is no longer orderable. When it is time to renew, the only option will be Advanced URL Filtering. Thanks, Tom
... View more
