I have a Malware and File Policy with the following criteria:
Application Protocol : Any
Direction of Transfer : Download
Action : Block Malware (Dynamic Analysis, Local Malware Analysis, Reset Connection)
Store Files : Unknown
Selected File Categories and Types: xyz and "Office Documents"
A connection to a .docx file was blocked, fair enough, the event details are as follows
Action : Malware Cloud Lookup.
I check File Trajectory, I can see it's blocked multiple times and the disposition is "Unknown"
My question is, my Malware and File policy is set to Block "Malware" file, when the disposition is "Unknown", why is the file being blocked??
