topic Re: Report show spam category with "accept" actions but not blocking in General Topics

Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Mon, 25 Mar 2019 08:05:50 GMT

Hi Everyone,

I'm doubting about the High-Risk Applications report was showing different action, although the application name was showing as the same category

I have 2 highlights, one is the red margin and another one is the green margin. Look at the red margin is shown to accept but not blocking. but the green margin is to show status alternately ( accept then block ) but some only show block

Does anyone describe above to me?

Really appreciate every comment

Regards,

Sarm

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Mon, 25 Mar 2019 08:49:18 GMT

You have different rules in your policy which allow the same URL/category for some user/source-ip and deny it for others. That's why it is reported that way.

Drill-Down to see the logs related to the entries and look on the matched rules!

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Mon, 25 Mar 2019 09:17:46 GMT

Hi Norbert

Look at rule no.22 and 23 these should be blocked spam, right?

Regards,

Sarm

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Mon, 25 Mar 2019 09:25:38 GMT

Rule 22 is negated in application column, so this is not relevant for spam.
Please show details of the logs allowing or blocking the same destination traffic. Then I might be able to tell you why the action is different.

e.g. double-click this line in the view:

Re: Report show spam category with "accept" actions but not blocking

PhoneBoy — Mon, 25 Mar 2019 13:43:24 GMT

Like Norbert said, we need to see the log entries to find out which rule it is accepting on.
Some sites/URLs have multiple categories and the traffic may be getting matched on a different (earlier) rule.

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Mon, 25 Mar 2019 15:49:39 GMT

Hi Norbert

Okay, let me check if I can see the log entries that relevant spam in the reports due to that report was correct since Nov 2018 - Jan 2019

I will update two of you again.

By the way, Is there any way to filter out with application name in the log entries view?

Thank you.

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Mon, 25 Mar 2019 15:51:29 GMT

Hi Admin,

I will provide you the log entries here once I find them.

Thank you

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Mon, 25 Mar 2019 18:53:36 GMT

Hi All,

Please see the log entries that I was able to find some of them below.

For example, "stat.tracker.ared.re

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Mon, 25 Mar 2019 19:17:36 GMT

The rule matched on application layer was rule number 23, but it looks like it was a different then the one you showed with block. The rule name is different, it is „Allow WiFi VIP.....“.

Click the rule name in the log and you will get to the matching rule.

Re: Report show spam category with "accept" actions but not blocking

Wolfgang — Mon, 25 Mar 2019 20:13:59 GMT

The logs you are showing are from 30 Jan 2019. The installed policy is from some hours earlier.

Today we had March 25. Maybee you changed something in the rulebase and as a result the shown rulenumbers doesn‘t match.

As the other checkmates members wrote, clicking the rule entry in the logs brings up the matching rules.

The rule UIDs are not changing over time, but the rule numbers at the beginning of a rule line.

Wolfgang

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Tue, 26 Mar 2019 06:05:00 GMT

Hi All

I tried to click the rule entry that problematic, found an error "failed to perform navigation" when clicking both rule number and a rule name column. They might be changed something but not sure this would be related to my report showing since 1Nove2018 - 31Jan 2019. As a result, we saw a spam site allowing in the report.

Please kindly advise me if I'm wrong.

Thank you.

Sarm

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Tue, 26 Mar 2019 07:06:45 GMT

Looks like the rule doesn't exist anymore.

You could try to find the rule by opening a revision from the history looking at the timeframe of the log entries.

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Tue, 26 Mar 2019 09:38:11 GMT

Hi Norbert

Thank you for your recommendation, I will try to and update you again.

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Wed, 27 Mar 2019 05:47:24 GMT

Hi Nortbert,

I just checked on the previous revision at the timeframe of the log entries, found that the rule number 23 which was previously set to allow but it supposed to fall the rule number 22 first then next to rule 23 respectively.

Any ideas?

Thank you

Sarm

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Wed, 27 Mar 2019 06:45:31 GMT

How come you think it should match rule 22.
The category in your log entry is "Spam" which is not covered by rule 22.

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Wed, 27 Mar 2019 06:54:19 GMT

Hi Nortbert

Sorry, it was my fault I did not notice that there was no spam category in by rule 22.

But anyway, Can you clarify me regarding some application name that displayed in the reports shown action with accept then block in the same column?

Thank you
Sarm

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Wed, 27 Mar 2019 07:13:18 GMT

Now we know why we have the Accept. Now focus on Block.
Which rule is matching for Block? again look at the relevant log entry!

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Wed, 27 Mar 2019 07:52:39 GMT

How can we filter the application with xl-trk.com? Because I need to retrieve the historical data that relevant to this log entry. It will help me faster to query.

Re: Report show spam category with "accept" actions but not blocking

Norbert_Bohusch — Wed, 27 Mar 2019 07:57:12 GMT

Easiest way is double-clicking the view on the relevant row.

But you can try free text search...

Re: Report show spam category with "accept" actions but not blocking

Sarm_Chanatip — Wed, 27 Mar 2019 08:53:35 GMT

Hi Norbert

Please see screenshots as below