False Positive Submission in Cisco Iron

[Elad Goldenberg]

Hi,

I would like to submit a request to remove a website that flagged by Cisco as malicious but it's a false positive. can you please guide me how to do that.

Thank you

[Libin Varghese]

Elad,

It is recommended you open a TAC case with the URL which needs to be reviewed and they would be able to get it analysed for you.

You could open a support case directly with Talos support, however it would be suggested you go through TAC if you have a active support contract with Cisco.

https://www.talosintelligence.com/reputation_center/support

Regards,

Libin Varghese

[Mathew Huynh]

Hello Elad,

Alternatively, if you do have a valid contract and CCOID, you can open a request directly via the security hub.

Requirements:

• Log in via Cisco account. (CCOID)  with an active support contract.
• URL in question and the associated WBRS score which is blocking it from access, or allowing it through depending on FN or FP behaviour

URL to access: https://securityhub.cisco.com/web/submit_reputation_urls for Web Reputation

URL to access: https://securityhub.cisco.com/web/submited_urls for recategorization

You will be able to monitor the status of the requested reports and will be contacted directly – allowing you to reach out to our WBRS team directly rather than opening a TAC case to reach out to the WBRS team on your behalf.

Regards,

Matthew