Hey everyone -- I opened a new ticket on slightly related topic as we were seeing blocks due to NBAR ID: 1889 but no classification back in early decemember.  Here was Supports response:   Is there a more recent event of this happening? The latest Event Log entry for this client as a Layer 7 firewall rule is on Dec 2. We actually removed NBAR 1889 from our ruleset on Dec 13th so you shouldn't see this hit any longer. Regards, Bryon Adams    I'm not sure if that addresses some of these issues we've all put workarounds in for but I wanted to share ... View more

I will tell you we are on 17.10 and we see SCCM internally being blocked by L7 rule and being classified as Statistical Peer-to-Peer         ... View more

following.. ... View more

In my case - this was partly due to a setting (my issue was with AMP on ASA firewalls but similar database) was that in the management console for the file policy you can tell it to override Talo's disposition based on the ThreatGrid score.  TAC said because the way the update file works it is capable of being malicious so it gives it a very high threat score. In our case, we told our appliances to mark it as malware if the threat score was Very High.  Not sure if this is relatable to you guys but wanted to mention it ... View more

We're getting these as well on our FTD VPN FWs with AMP   <*- Network Based Malware From "VPN-FTD01" at Mon Aug  5 20:31:33 2019 UTC -*> Sha256: 7b512b45b6903b562e7f52b04a7715c05f0bb0cfc42438d6f1f2cdbb32124ac6 Disposition: Malware Threat name: W32.7B512B45B6-100.SBX.TG IP Addresses: x.x.x.x<-23.204.228.68     However Talos shows it as clean... ... View more