Audit shows blocked activity as data transfer

Products

• CASB Audit
• CASB Gateway Advanced
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

Audit shows a 403 forbidden blocked activity as data transfer.  

Environment

CloudSOC Audit with a WSS integration data source

Cause

WSS logs a 200 success on the TCP traffic initiating the handshake with Audit, but receives a 403 forbidden on the http/https traffic giving you a blocked page. 

Resolution

Open a support ticket to request "Ignore CONNECT Traffic" on your WSS data source.