topic Re: Microsoft Application objects for OneDrive and Oulook in General Topics

Microsoft Application objects for OneDrive and Oulook

David_C1 — Fri, 28 Apr 2023 14:24:08 GMT

There seems to be a certain amount of application signature bloat for Microsoft services, or perhaps someone can shed some light on the differences between the highlighted applications below:

This has always confused me, but became a problem after a recent lifecycle and upgrade of one of our clusters. Under R80.40, we were allowing Outlook traffic using the application "Microsoft-Outlook-web". After a lifecycle, which included an upgrade to R81.10, Outlook traffic was blocked and was classified by application "Office365-Outlook-web." Why two different applications for what seems to be the same thing? Check Point's documentation on this (e.g. sk110679) is pretty bare and hasn't been updated in almost 2 years. Any other documentation I'm missing?

Dave

Re: Microsoft Application objects for OneDrive and Oulook

the_rock — Fri, 28 Apr 2023 14:38:07 GMT

You are not missing anything and yes, I agree 100% about the documentation about it. Anyway, I had same situation with customer on R81.10 and we had to allow whatever was listed there, even TAC said there was really no other good workaround.

Re: Microsoft Application objects for OneDrive and Oulook

David_C1 — Fri, 28 Apr 2023 14:46:36 GMT

Thank you for the corroboration.

Another point of confusion for me, if I allow the application "Office365 OneDrive-web", does this also allow "Office365 OneDrive-web-upload" and "Office365 OneDrive-web-remove"? Or if I allow "Microsoft Outlook-web", does this also allow "Microsoft Outlook-webupload" and "Microsoft Outlook-web-download". I believe the answer is yes. How about if I allow the application "Microsoft Services" does this allow everything Microsoft? What is really needed is documentation around parent/child application signatures, i.e. what applications include other applications.

Dave

Re: Microsoft Application objects for OneDrive and Oulook

the_rock — Fri, 28 Apr 2023 14:49:35 GMT

Funny you ask that question, because my customer asked TAC exact same one and they said yes to both, BUT guy also said to be safe,we should test each one and see the results, so that answer did not instill confidence, at leats for me : - ). So, we did test and it turned out to be the case, what your assumption is.