Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 26 subscribers
  • Views 416 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

InvalidUrl - how to interpret report?

MakaanPL

Hello,

In Sophos XG reports, there is a Web Category named "InvalidUrl" which cannot be used in web filtering policy. There's a big number of requests and bytes transferred.

One of the "URLs" is highlighted, it's just a very long string, the second one looks very similar. Port 17472 may be related to Tanium software, and by capturing packets I know there's indeed a communication to this port to my employer's IP. But this "URL" is a mystery, packet capture of DNS didn't catch it so far.

What has actually happened? How to interpret it?



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Website which don’t have valid URL format will categories in Invalid URL.

    Could you please try to do DNS lookup manually to one of these URLs? Export this report in csv to get the correct domain.

    Do you see any log event in awarrenhttp_access.log with this URL?

    It would be great if you can share csv here as well.

Reply
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Website which don’t have valid URL format will categories in Invalid URL.

    Could you please try to do DNS lookup manually to one of these URLs? Export this report in csv to get the correct domain.

    Do you see any log event in awarrenhttp_access.log with this URL?

    It would be great if you can share csv here as well.

Children