Difference between "Blocked By WebPulse" and "Blocked By Antivirus" in WSS Reports
search cancel

Difference between "Blocked By WebPulse" and "Blocked By Antivirus" in WSS Reports

book

Article ID: 248693

calendar_today

Updated On:

Products

Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

When the Security report "Trend of Threats" is executed, you may notice that some activities are blocked by WebPulse, while the others are blocked by Antivirus:

Resolution

To understand the difference, you may click on "WebPulse" and then on "Antivirus" hyperlinks. This will show that:
- "Blocked By WebPulse" is related to the category which contains "spyware", "suspicious", "phishing", or "malicious"
which means that it is blocked based on the URL category (https://sitereview.symantec.com/#/)

- "Blocked By Antivirus" is sowing the results where Malware is not -EMPTY-
so this is blocked by the antivirus component

 

Another method to notice the difference would be to execute "Threats" report. It then shows what particular threat (in case of WebPulse - category) was blocked by: