topic Re: Wrong category for a URL in URL filtering blade R81.10 in Firewall and Security Management

Wrong category for a URL in URL filtering blade R81.10

mrodriguez — Thu, 25 May 2023 14:45:40 GMT

Hi all!

When my costumer try to access to http://www.cype.net/versiones/2023/* the gateway categorizes it as Spyware / Malicious Sites and blocks the traffic according to a rule.

However in URL Categorization | Check Point Software Technologies this URL is categorized as Bussiness / Economy. Could anyone help me with this isssue? Thanks

Re: Wrong category for a URL in URL filtering blade R81.10

the_rock — Thu, 25 May 2023 14:57:58 GMT

Just add custom category like below above rule blocking it as high app risk. If you have appc/urlf ORDERED layer, just add it there. If its only one layer, then just make sure rule is, as I mentioned, above one that currently blocks it.

Andy

Re: Wrong category for a URL in URL filtering blade R81.10

mrodriguez — Thu, 25 May 2023 15:04:27 GMT

Thank you very much. I have implemented another workaround, but I think that the right behaviour should be GW categorization matches with "Checkpoint Cloud" categorization. Isn't it?

Re: Wrong category for a URL in URL filtering blade R81.10

the_rock — Thu, 25 May 2023 15:09:16 GMT

I agree. You should request re-categorization if proof is sufficient. I checked Fortinet web filter and it appears right category.

Andy

Re: Wrong category for a URL in URL filtering blade R81.10

mrodriguez — Thu, 25 May 2023 15:37:32 GMT

Thanks Again. I have checked this URl in Checkpoint URL Categorization and It shows this:

This why I don't understand what is happening

Re: Wrong category for a URL in URL filtering blade R81.10

the_rock — Thu, 25 May 2023 15:40:06 GMT

Different vendors would categorize certain sites differently...based on below, it still shows Information Technology

https://www.fortiguard.com/webfilter

Andy

Re: Wrong category for a URL in URL filtering blade R81.10

Lloyd_Braun — Thu, 25 May 2023 21:07:43 GMT

I have a ticket open for a similar issue. The Check Point URL lookup site shows the category as Computers / Internet, but the Check Point log card is showing the same URL as Spyware / Malicious, High Risk, just like yours does. Not sure if this is to be expected that the Check Point URL lookup site is not consistent with the realtime URLF blade for the Spyware / Malicious category set.

Re: Wrong category for a URL in URL filtering blade R81.10

PhoneBoy — Thu, 25 May 2023 21:20:05 GMT

This may be coming from ThreatCloud instead of the URL Filtering database.
Recommend checking the issue with TAC: https://help.checkpoint.com