This article provides information on why ATP cloud does not apply the defined action on the first sample even though traffic threat level is more than the defined level

Even if the threat level is set to 7 or higher on the ATP cloud and the action is set to quarantine, the first sample is allowed to pass through SRX without the quarantine action being implemented, despite the fact that the threat level for the first sample surpasses 7.

This is an expected behaviour.

The first sample must be allowed to proceed because, with that, the entire sample can be uploaded to the cloud for analysis. This analysis will determine whether the sample is good or bad. Subsequently, based on our past analyzed results, the policy of blocking or quarantining can be applied to this sample.

The following samples with the same type of content will be quarantined or blocked as per the configured action.

If the configured action is not being applied to the following samples, please reach out to JTAC.