How to indicate new URL to Check Point

[zsszlama]

Hi,

Lately we have encountered that when our customer creates a new a URL that is blocked by gateway due to Protection Type: DNS Reputation. As a workaround we create an exception for it.

My question is how we can indicate this to Check Point modify the reputation of the new URL to safe? I'm aware of https://urlcat.checkpoint.com/urlcat/main.htm but it's for categorization and in most cases the category of the URLs are valid, so it's not a solution.

An SK about a new URL's life would be also useful what we could show to our customers.

Could you please these questions?

Thanks,

Zsolt

[_Val_]

As part of the process, DNS reputation checks how long a domain/URL exists. To avoid false positives, an exception is the best way, since you know in advance what that domain / URL would look like.

[zsszlama]

I thought that lifetime is the key indicator. Are you aware of any time limit for that even an SK what we could show to our customer?
(I don't want to advertise other vendors but I found such documents at the other big 2)

[PhoneBoy]

URL Categorization (for Access Control) and Threat Prevention are handled differently.
You have the correct URL for reporting the correct category.
For false positives with respect to Threat Prevention, those need to be done through TAC: https://help.checkpoint.com 

As for how the other “big two” handle this, you’re welcome to provide links to the relevant information since I’m not entirely clear what the actual question is here.

[zsszlama]

URL categorization is valid according so that's why I was asking for guidance. Yeah, as a workaround we've created a threat prevention exception and raised a ticket.

Those are not great articles but at least something what I could share to a customer:

- https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPImCAO

- https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Newly-Observed-Domain-Webfilter-cate...

[PhoneBoy]

I'm guessing the question is how we handle things we flag as "DNS Reputation."
Unfortunately, I haven't seen any documentation on this.
I do know that feedback is a part of the process, though. 

[G_W_Albrecht]

URL reputation is estimated by several services / sites, and CP is also using that information sources. You will have to contact each of these that report the bad reputation.

But it can be the AV / AB blade that is reporting a certain URL as containing malware (look into log details) - in this case, TAC can help after opening a CP SR#.