Advanced threat protection exception not working

From my testing you will also need an IPS exception. The site is classified as unfriendly.

Ian

Do you mean a firewall rule to that domain with IPS disable?

No, an IPS in policies..

You will need to build a new IPS policy.

Ian

Now I have this exceptions like this

 IPS exception like this applied

And now I get DNS requests blocked

IPS seems to be working, but in ATP if i don't use the source IP it looks like the tread exception field is not working properly.

In any case I consider this a bug, since it is an inconsistency, If I whitelist something in ATP I wouldn't expect to see it blocked in the ATP log, if it is an IPS event then it should appear in the IPS log.

Now I have this exceptions like this

 IPS exception like this applied

And now I get DNS requests blocked

IPS seems to be working, but in ATP if i don't use the source IP it looks like the tread exception field is not working properly.

In any case I consider this a bug, since it is an inconsistency, If I whitelist something in ATP I wouldn't expect to see it blocked in the ATP log, if it is an IPS event then it should appear in the IPS log.

Your log is showing it is being blocked by IPS not ATP.

Application and IPS work hand in hand otherwise you do not get the classification.

If you think it is a bug, raise a support case.

Ian