URL Reputation False Positive Process

Products

• Endpoint Security
• Endpoint Security Complete
• Endpoint Security for Servers

Issue/Introduction

A URL is believed to be incorrectly detected by the Endpoint Security/Endpoint Protection URL Reputation feature resulting in a False Positive.

Commonly seen URL Reputation detections include:
[SID: 29565] Web Attack: Webpulse Bad Reputation Domain Request  
[SID: 60501] URL reputation: Browser navigation to known bad URL  

Resolution

Use the following steps to submit a URL Reputation False Positive

1. Visit https://sitereview.symantec.com and enter the URL you want reviewed, then click Check Category.
   
   
2. If you disagree or wish to dispute the resulting URL categorization, click on the "thumbs up" or (blue) Other option under Do you agree with the current categorization?... and then continue with the next steps.
   
   
3. Complete the following fields.
   
   
   • Filtering Service: Symantec Endpoint Security.
   • Your suggested category or categories: Choose an appropriate category.
   • Email Address: Enter your email address.
   • Comments and Site Description: Paste the text "URL being submitted for False Positive review".
     
     
4. Click Submit for Review.

WebPulse Site Review can only be used to submit one URL at the time, and does not currently support bulk submissions for suspected False Positives.

If you are interested in a long term solution to reduce the number uncategorized sites (websites not reviewed), Symantec offers a Symantec WebPulse Automation Kit (SWAT) subscription. SWAT subscription can be used to send bulk submission through Symantec WebPulse Automation Portal/API (only accessible by SWAT subscribers).

Contact your Sales Team for Symantec WebPulse Automation Kit (SWAT) pricing and information.