topic Re: Threat Prevention in General Topics

Threat Prevention

Aleksey135563 — Fri, 06 Feb 2026 08:41:03 GMT

Could you please tell me why the exclusion rule in the Threat Prevention policy might not be triggered? We configured an exclusion rule for Threat Emulation at the IP address src:10.216.5.184 dst:146.75.119.52 (for the resource download.postgresql.org), but judging by the ITU logs, the rule isn't triggered and traffic is being routed to emulation. Traffic to emulation is routed to the following devices in the screenshot.

Re: Threat Prevention

tankp — Fri, 06 Feb 2026 09:10:46 GMT

I cannot determine from the screenshots whether the connection matched the exception rule. You can try clicking the "Add Exception" button in the connection's detailed log or consider creating a Global Exception rule.

Re: Threat Prevention

Aleksey135563 — Fri, 06 Feb 2026 11:49:29 GMT

Re: Threat Prevention

the_rock — Fri, 06 Feb 2026 12:09:03 GMT

I dont see the gateway listed for policy install referenced in the other screenshot you attached. Maybe thats the reason? Im referring to one called fw-internet.

Re: Threat Prevention

Martijn — Fri, 06 Feb 2026 12:36:37 GMT

Hi,

Did you made a typo in the object's configuration?
Object name is 10.216.5.184 but is the configured IP correct?

Have had this before and could not find out why a rule was not hit. It was a typo in the objects configuration.

Martijn

Re: Threat Prevention

the_rock — Fri, 06 Feb 2026 13:08:20 GMT

Excellent point @Martijn . I had seen that happen to few people before, definitely worth checking.

Re: Threat Prevention

Aleksey135563 — Fri, 06 Feb 2026 13:11:01 GMT

Thanks to everyone for the feedback, I'll try to make the rule using a different logic.

Re: Threat Prevention

the_rock — Fri, 06 Feb 2026 13:12:33 GMT

There is absolutely nothing wrong with your logic. Just make sure as Martijn said IP is correct and also policy is installed on the right gateway.