Umbrella Incorrect Content Categorization

[netadmin_auk]

We are facing an issue with Cisco Umbrella after migrating to the new Content Categorization. Many subdomains and CDNs are categorized as Not Actionable which is blocked. Before the new Contact categorization, these domains, subdomains, and CDNs were categorized properly as CDNs or business websites or whatever it should be.

We have opened multiple TAC cases to address this serious issue as it is impacting our business. However, the solution was to dispute/allow each URL/Domain/Subdomain separately at your own risk.

For example:

theaudiencestreet.com is categorized as "Business and Industry". However, the subdomain r.theaudiencestreet.com is categorized as "Not Actionable" (Screenshots attached)

Another example:

careercenter.americananthro.org categorized in Talos as "Job Search". However, it is categorized in Umbrella as "Not Actionable"

Can someone please advise us on how to solve this issue efficiently? or should I change the product?

[aaragonb]

I understand that you are experiencing problems with Cisco Umbrella's new Content Categorization system. I can appreciate how disruptive this could be for your business. That's why we need to narrow it down as much as we possibly can:

- is this happening only with the "Not Actionable" category?

- how many domains fall into the "Not Actionable" category when they shouldn't?

For every single domain wrongly categorized in Umbrella, I would add them to a list and I would send it to Umbrella support for them to take the proper action.

If you see a domain category is wrong both in Umbrella and Talos, then, I would open a case with Talos directly, you can see here how: https://support.umbrella.com/hc/en-us/articles/360059002632-How-To-Submit-A-Talos-Categorization-Request

If by any chance, you have an urgent issue caused by categorization, please open a P1 case with Umbrella support.

As a workaround, if the issue is only with one category, I would study the possibility of not blocking that category temporarily but making sure that the policy has strong security settings in place.