URL Reputation False Positive Process

Products

• Endpoint Security
• Endpoint Security Complete
• Endpoint Security for Servers

Issue/Introduction

A URL is believed to be incorrectly detected by the Endpoint Security/Endpoint Protection URL Reputation feature resulting in a False Positive.

Commonly seen URL Reputation detections include:
[SID: 29565] Web Attack: Webpulse Bad Reputation Domain Request  
[SID: 60501] URL reputation: Browser navigation to known bad URL  

Resolution

Use the following steps to submit a URL Reputation False Positive

1. Visit https://sitereview.symantec.com and enter the URL you want reviewed, then click Check Category.
   
   
2. If you disagree or wish to dispute the resulting URL categorization, select Other (if you believe the site is safe) or Risky (if the site requires a security category) under "Do you agree with the current categorization?..." and then continue with the next steps.
   
   
3. Complete the following fields.
   
   
   • Filtering Service: Symantec Endpoint Security.
   • Your suggested category or categories: Choose an appropriate category.
   • Email Address: Enter your email address.
   • Comments and Site Description: Paste the text "URL being submitted for False Positive review".
     
     
4. Click Submit for Review. Once submitted, the Web Pulse team will process your request within 30 mins.  Occasionally, however if your submission requires manual review / intervention their response back will vary.

NOTE: For "post-submission" inquiries related to bump in priority requests, all URL recategorization questions and or update inquiries, please reply back to the email you received from the Web Pulse Team.  

Alternatively, you can also email the Web Pulse team directly using: [e-mail] along with your earlier submission URL and inquiries, and the team will reply back as soon as possible.

*NOTE: WebPulse Site Review can only be used to submit one URL at the time, and does not currently support bulk submissions for suspected False Positives. 

**For bulk submissions:
If you are interested in a long term solution to reduce the number uncategorized sites (websites not reviewed), Symantec offers a Symantec WebPulse Automation Kit (SWAT) subscription. SWAT subscription can be used to send bulk submission through Symantec WebPulse Automation Portal/API (only accessible by SWAT subscribers).
Contact your Sales Team for Symantec WebPulse Automation Kit (SWAT) pricing and information.