Report show spam category with "accept" actions but not blocking

[Sarm_Chanatip]

Hi Everyone,

I'm doubting about the High-Risk Applications report was showing different action, although the application name was showing as the same category  

I have 2 highlights, one is the red margin and another one is the green margin.  Look at the red margin is shown to accept but not blocking. but the green margin is to show status alternately ( accept then block ) but some only show block

Does anyone describe above to me?

Really appreciate every comment

Regards,

Sarm

[Norbert_Bohusch]

You have different rules in your policy which allow the same URL/category for some user/source-ip and deny it for others. That's why it is reported that way.

Drill-Down to see the logs related to the entries and look on the matched rules!

[Sarm_Chanatip]

Hi Norbert

Look at rule no.22 and 23 these should be blocked spam, right?

Regards,

Sarm

[Norbert_Bohusch]

Rule 22 is negated in application column, so this is not relevant for spam.
Please show details of the logs allowing or blocking the same destination traffic. Then I might be able to tell you why the action is different.

e.g. double-click this line in the view:

[Sarm_Chanatip]

Hi Norbert

Okay, let me check if I can see the log entries that relevant spam in the reports due to that report was correct since Nov 2018 - Jan 2019

I will update two of you again.

By the way, Is there any way to filter out with application name in the log entries view?

Thank you.

[PhoneBoy]

Like Norbert said, we need to see the log entries to find out which rule it is accepting on.
Some sites/URLs have multiple categories and the traffic may be getting matched on a different (earlier) rule.

[Sarm_Chanatip]

Hi Admin,

I will provide you the log entries here once I find them.

Thank you

[Sarm_Chanatip]

Hi All,

Please see the log entries that I was able to find some of them below.

For example, "stat.tracker.ared.re

 

[Norbert_Bohusch]

The rule matched on application layer was rule number 23, but it looks like it was a different then the one you showed with block. The rule name is different, it is „Allow WiFi VIP.....“.

Click the rule name in the log and you will get to the matching rule.

[Wolfgang]

The logs you are showing are from 30 Jan 2019. The installed policy is from some hours earlier.

Today we had March 25. Maybee you changed something in the rulebase and as a result the shown rulenumbers doesn‘t match.

As the other checkmates members wrote, clicking the rule entry in the logs brings up the matching rules.

The rule UIDs are not changing over time, but the rule numbers at the beginning of a rule line.

Wolfgang

[Sarm_Chanatip]

Hi All

I tried to click the rule entry that problematic, found an error "failed to perform navigation" when clicking both rule number and a rule name column. They might be changed something but not sure this would be related to my report showing since 1Nove2018 - 31Jan 2019. As a result, we saw a spam site allowing in the report.

Please kindly advise me if I'm wrong.

Thank you.

Sarm

[Norbert_Bohusch]

Looks like the rule doesn't exist anymore.

You could try to find the rule by opening a revision from the history looking at the timeframe of the log entries.

[Sarm_Chanatip]

Hi Norbert

Thank you for your recommendation, I will try to and update you again.

[Sarm_Chanatip]

Hi Nortbert,

I just checked on the previous revision at the timeframe of the log entries, found that the rule number 23  which was previously set to allow but it supposed to fall the rule number 22 first then next to rule 23 respectively.

Any ideas?

Thank you

Sarm

[Norbert_Bohusch]

How come you think it should match rule 22.
The category in your log entry is "Spam" which is not covered by rule 22.

[Sarm_Chanatip]

Hi Nortbert

Sorry, it was my fault I did not notice that there was no spam category in by rule 22.

But anyway, Can you clarify me regarding some application name that displayed in the reports shown action with accept then block in the same column?

Thank you
Sarm

[Norbert_Bohusch]

Now we know why we have the Accept. Now focus on Block.
Which rule is matching for Block? again look at the relevant log entry!

[Sarm_Chanatip]

How can we filter the application with xl-trk.com? Because I need to retrieve the historical data that relevant to this log entry. It will help me faster to query.

[Norbert_Bohusch]

Easiest way is double-clicking the view on the relevant row.

But you can try free text search...

[Sarm_Chanatip]

Hi Norbert

Please see screenshots as below

[Norbert_Bohusch]

So as we see now, the Allow came from a rule matching only for 2 of your WiFi networks with Any Application and other sources are blocked from a rule further down, which Blocks the Spam category (besides others).
So that's why you see both actions in your view/report, because some were Allowed and others Blocked. So everything correct!

[Sarm_Chanatip]

Maybe you're right. I will give you an example to check if my understanding is correct.

If I create the application rules one for source A to dest Z with action allow and one for source B to dest Z with action drop, where Z is spam site or else this means I will see application name (Z), category "Spam" with both action in my report, right?

[Norbert_Bohusch]

correct

[Sarm_Chanatip]

Hi Norbert

Thank you for your great help and clarifying