Content Analysis requires access to several cloud-based resources when Symantec Cloud Sandboxing is in used.
A lot of "SandboxingSymcCloud::Submit - query_hash failed" error messages appearred.
Symantec Cloud Sandboxing enabled
The default configuration in WebUI -> Services -> Sandboxing -> Symantec Cloud Sandboxing -> Select a region -> Global
Normally, the customer would just allow URL api.us.dmas.symantec.com based on CAS's recommendations. The fact that it's depending what region setting has been configured either Global, US, or EMEA.
Global = api.global.dmas.symantec.com
US = api.us.dmas.symantec.com
Emea = api.eu.dmas.symantec.com
When CAS sends files to Symantec's cloud-based service for malware scanning. Content Analysis requires access to the followings URLs
api.global.dmas.symantec.com
api.us.dmas.symantec.com
api.eu.dmas.symantec.com