Application classification - NEW

Question

Hi folks, 
 over the last couple of days when reviewing the GUI - > reports section I see an application classification of 'NEW' which has many old sites eg facebook, twitter in the report. 
 This classification does not appear in the daily reports. 
 Thoughts please? 
 Ian

Michael Dunn · Accepted Answer

My understanding is that a common workflow is this: On Day 1 there are a dozen applications, they are all New. Admin goes through and sets them to sanctioned or unsanctioned (which only changes their colour). Admin creates application control policies to block certain cloud apps. On Day 2 there is only green. Only sanctioned apps are there. The blocked cloud apps are blocked by policy and there is nothing new. On Day 3 there is green with a little red. Some app that you previously said you is unsanctioned made it through your policy. You adjust your application control policies. On Day 4 there is green with a little blue. There is a new app for you to look at. You do so, think it is ok, and mark it sanctioned. Now it will come through as green. 
 
 The New / Sanctioned / Unsanctioned do not in themselves affect the traffic. The affect the reporting so that the admin can decide what to do. Ultimately an admin needs to know "What do I have to deal with today" and usually that is "what is going on that I have not already dealt with". By marking acceptable cloud application traffic as green, they can then ignore it. 
 
 Whether a specific cloud app like Google Drive is sanctioned or not in a particular company is a per-Admin decision. AFAIK Sophos indicates Category, etc (like any app) but the admin decides if it is sanctioned at their company. The word "sanctioned" is used rather than "allowed" because we tend to use "allow" for policy decisions.