Issues with fail open settings

[Jagan23]

The current configuration is a fail-open which means that the traffic will be allowed in case the URL will be unknown.

Changing to a fail-close will have impact on all the environment since all the HTTPS traffic toward website with unknown reputation will be blocked until the checkpoint receive a status on those websites.

We are getting bombarded with alerts from SOC, when ever a user logins to a DC, stating that he has accessed a malicious URL.

I believe this is because of the fail-open settings. Is there any customization that can be done to prevent this from happening. Please check and let me know.

Some of the URL's reported are below,

media[.]jtdwjcwq6f4wp4ce[.]com

ns1[.]telecom-info[.]com

[PhoneBoy]

The fail open/closed settings apply when you cannot reach the URL Filtering backend (or some other error related).
Uncategorized URLs can be blocked, but this is done in the Access Policy.

One of the URLs reported definitely looks suspicious:

[Jagan23]

That is some of the URL's I listed. I think this is happening when ever domain controllers do DNS query. Since we have fail-open setting all the URL's are allowed. Is there a way to specifically block these malicious URL while doing DNS queries. Please let me know.

[Lesley]

I don't get this part:

when ever a user logins to a DC, stating that he has accessed a malicious URL

How does the drop look on the firewall? I assume it is dropped there? Or how does it look what this SOC is getting?