About mario11584

I'm not sure how to fix this problem, without using a different service. But we currently block the adult-and-pornography category. We get multiple complaints a day for sites getting blocked because they are categorized as adult-and-pornography. Researching the sites shows about 99.99999999% of the time that these sites are clearly not pornographic. It seems the URL filter is using this as a default category. Is there anyway to resolve this? Can I make a different default category, if that is the issue? I submit categorization change requests multiple times a day and it's getting very old. We tested the PAN DB a while ago but that wasn't much better. ... View more

I searched for this on the forum but couldn't find it so I apologize if this is a repeat question. I'm trying to pull a report just as it's shown in the ACC. Starting off without any filters, within the ACC, I click on the "online-personal-storage" URL filtering category. This displays the top applications in that category. That's perfect! That's what I want. Then I try to export just that exact data just as it's displayed in a report (not like it is in the URL logs) but I can't. Am I missing something? I try to create a custom report but it doesn't give me "bytes" as a column option AND it doesn't report anything. The reports returns blank. I want it just like it is shown within the ACC. Any ideas? ... View more

We implemented the DNS Sinkhole feature about the time 6.0 came out. I've actually had a hard time using the threat and traffic logs for incident response. We can't pinpoint which hosts are hitting what URLs or malicious domains. The threat logs show all the suspicious DNS queries that come from our DNS servers but not the hosts themselves (because the request came from the DNS server). The host details show up in the traffic logs, but of course you don't see the URL or the malicious domain in the traffic logs (just the configured Sinkhole IP address). How do I figure out where the hosts are trying to go? It seems with the way this is designed that this is not possible. We can only get the Sinkhole IP. It's become such a pain for our security team to try to track down information regrading threats to hosts they are implementing FireEye for better tracking. This has recently become a much bigger issue for us since over the weekend our inboxes were flooded with alerts of DNS Sinkhole Alerts (traffic matching our security policy that was setup for the Sinkhole IP). Over the weekend we received hundreds of emails with these alerts. It seems as if the application and threats database was updated, possibly incorrectly, kicking off all of these alerts. That is just a guess though of course. The other fear we have is something is spreading through our network. How do I use the sinkhole logs to track down where hosts are going to kick off these alerts? Also, any more help in understanding how to use this feature would be appreciated too. Maybe this all due to my lack of understanding it. ... View more