Endpoint hitting correct rule in live Log, but shows up incorrectly in Conext

[Josh Morris]

I have been trying to properly profile devices and get them put into specific rules instead of the last rule. My last rule is called 'Closed_Mode'. I want the endpoint to hit the AuthZ rule 'Global..SJ_Computers'. it appears to hit the proper rule in the Live Log, but the endpoint in the context visibility page shows it hitting 'Closed_Mode' instead.

[hslai · Accepted solution]

This usually happens when the endpoint hits one policy rule earlier and then changes to another. It might take sometime for the update to reflect on the context visibility.