Audit shows blocked activity as data transfer

Products

• CASB Audit
• CASB Gateway Advanced

Cause

The WSS logs a 200 success on the tcp traffic initiating the handshake, but a 403 forbidden on the http/https traffic to load a blocked page. 

Environment

WSS integration data source

Resolution

Open a support ticket to request "Ignore CONNECT Traffic" on your WSS data source.