URL Reputation False Positive Process

Products

• Endpoint Security
• Endpoint Security Complete
• Endpoint Security for Servers

Issue/Introduction

A URL is believed to be incorrectly detected by the Endpoint Security/Endpoint Protection URL Reputation feature resulting in a False Positive.

Commonly seen URL Reputation detections include:
[SID: 29565] Web Attack: Webpulse Bad Reputation Domain Request  
[SID: 60501] URL reputation: Browser navigation to known bad URL  

Resolution

Use the following steps to submit a URL Reputation False Positive

1. Visit https://sitereview.symantec.com and enter the URL you want reviewed, then click Check Category.
   
   
2. If you disagree or wish to dispute the resulting URL categorization, click on the "thumbs up" or (blue) Other option under Do you agree with the current categorization?... and then continue with the next steps.
   
   
3. Complete the following fields.
   
   
   • Filtering Service: Symantec Endpoint Security.
   • Your suggested category or categories: Choose an appropriate category.
   • Email Address: Enter your email address.
   • Comments and Site Description: Paste the text "URL being submitted for False Positive review".
     
     
4. Click Submit for Review.

WebPulse Site Review can only be used to submit one URL at the time, and does not currently support bulk submissions for suspected False Positives. 

If you are interested in a long term solution to reduce the number uncategorized sites (websites not reviewed), Symantec offers Priority Rating Service (PRS) subscription. PRS subscription can be used to send bulk submission through Priority Rating Service Portal/API (only accessible by PRS subscribers), the default product is 100 URLs/day for one year.

Contact your Symantec Sales Engineer (SE) for Priority Rating Service pricing and information.