Increase in missing detections or a higher rate of false positives, after disabling GTI cloud lookup in Skyhigh Web Gateway

Technical Articles ID: KB85830
Last Modified: 2023-06-27 08:41:16 Etc/GMT

Environment

Skyhigh Web Gateway (SWG)

Gateway Anti-Malware (GAM) engine
Global Threat Intelligence (GTI)

Problem

When you change your SWG configuration to disable GTI cloud lookups, you see a rise in the number of missed detections, or a higher rate of false-positives.

Cause

Sending the URL of a scanned file to GTI to determine its source reputation (GTI) is critical to the GAM engine. This action allows the engine to establish a context and accurately classify the file.

If the GAM engine can't use the GTI detection capabilities, the observed detection rate is the same as older, pre-2014 GAM engines. This inability to use the GTI detection capabilities causes missed detections, or a higher than expected rate of false-positives.

Some of the information that the GAM engine retrieves from the URL lookup, such as URL categories or Geolocation, is available in the local URL filter database. But, much of the information, such as URL web reputation, can be retrieved only from the GTI cloud.

Solution

To use the GAM engine detection capabilities and to reduce the risk of false-positives, enable GTI cloud lookups:

Log on to the SWG user interface.
Click Policy, Rule Sets.
Select the Gateway Anti-Malware rule set and click Show details.
Make sure that the Advanced Setting Enable GTI file reputation queries is enabled.
Verify that the Set URL Filter Internal Settings rule exists in your policy. If not, import the rule from the Rule Set Library.

NOTE: This rule set defines a URL filter configuration that's used when the AV filter queries the URL filter for URL categories, URL web reputation, and other information.
The settings object that the event in the rule uses for this rule set must have Use online GTI web reputation and categorization services if local rating yields no result enabled under Rating Settings.
Add the rule to your policy.
Move the rule to the top of your policy.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Increase in missing detections or a higher rate of false positives, after disabling GTI cloud lookup in Skyhigh Web Gateway

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Increase in missing detections or a higher rate of false positives, after disabling GTI cloud lookup in Skyhigh Web Gateway

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title