Audit shows a 403 forbidden blocked activity as data transfer.
CloudSOC Audit with a WSS integration data source
WSS logs a 200 success on the TCP traffic initiating the handshake with Audit, but receives a 403 forbidden on the http/https traffic giving you a blocked page.
Open a support ticket to request "Ignore CONNECT Traffic" on your WSS data source.