About dyang

Hi Bhavin, Thanks for the feedback.  As a previous user mentioned, this is currently behaving as-designed since the URL filtering is categorizing against the domain (translate.google.com), while Google requests and serves the translated content.  We are aware of this limitation and are investigating ways in which to best address this. Thanks, Doris ... View more

Manni, There shouldn't be a problem with 3.1.8.  Can you open a support ticket and include a PCAP and/or a sample of the file in question so we can take a closer look? --Doris ... View more

Thanks for your continued patience, Manni.  I'll see what I can find.  ... View more

As Alfred stated above, we only use one category from BrightCloud.  If a URL gets categorized with multiple categories, we use the one with the highest confidence score.  If you do a categorization check via BrightCloud's website, this is generally the first category that's listed. --Doris ... View more

Hi Manfred, When attempting to detect .sys and .reg files in a mail attachment, did you also have an SSL policy setup to decrypt the traffic?  Or are you testing all file types in the same manner and only .sys and .reg files were not being properly detected? Generally speaking, our file signatures are based on the unique characteristics of each file, not just on the file extension itself.  If you're experiencing an issue with .cmd files, please open a support case so we can investigate further. --Doris ... View more

Hello, While BrightCloud provides a reputation score for URLs, the Palo Alto Networks URL filtering engine does not utilize this score in policy.  If this is a feature you'd like to see, please contact your SE to file a feature request. Hope this helps, Doris ... View more

Hello, I'm assuming you're referring to the file types that we can block via file filtering, correct?  You can find the full list of supported file type signatures here: https://live.paloaltonetworks.com/docs/DOC-1783 If there is a file type that you'd like to see added, please contact your SE and have them file an enhancement. Thanks, Doris ... View more

Hello, BrightCloud classifies URLs as "spam-URL" as URLs that are contained in spam messages.  You can find the full list of category descriptions here: http://www.brightcloud.com/support/catdescription.php Please do continue to submit category change requests as they will only help to improve the database.  Should you also have a long list of URLs that you would like to submit changes for, you may also open a ticket with support to submit your entire list. Thanks, Doris ... View more

Hi Bobby, Since you are generating the report from the traffic log, you will see category "any" for traffic that did not go through the URL filtering engine.  If you run the same report against the URL filtering log, you should not see category "any". Category "unknown" refers to a URL that is currently uncategorized by the URL filtering database.  This can happen when a new URL has been created and the crawler has not had time to categorize it yet.  When a dynamic lookup returns an "unknown" category, it is added to the list of URLs for the crawler to analyze and categorize.  What this means is that while the initial lookup returned category "unknown", subsequent dynamic lookups should return a category. If you'd like to suggest a category for unknown URLs (or request a categorization change for known URLs), you can do so here: http://www.brightcloud.com/support/lookup.php I'm unsure of where you're seeing category "uncategory".  Do you have a screenshot? Hope this helps, Doris ... View more

Hi Bobby, Can you describe the steps you took to generate the log?  Also, what device are you using, what version, and what version is your content file? Thanks, Doris ... View more

Hi there, It looks like you couldn't detect EICAR over HTTPS.  Do you have an SSL decryption policy set and enabled? ... View more

There is some additional information available on page 149 (Table 71) of the PA-4.0 Administrator's Guide. ... View more