Disposition reference
If you are using an SIEM integration to send log data to a third-party SIEM product, use the following table to map the ID shown in the dispositionNumber field to the action applied to the request.
The table also shows how each number is summarized in the dispositionString field.
| ID | Description | Summary |
|---|---|---|
| 1024 | Category permitted, not set | Permitted |
| 1025 | Category blocked | Blocked |
| 1026 | Category permitted | Permitted |
| 1027 | Custom URL, category blocked | Blocked |
| 1028 | Custom URL, category permitted | Permitted |
| 1029 | Always blocked | Blocked |
| 1030 | Never blocked | Permitted |
| 1031 | Blocked by limited access filter | Blocked |
| 1032 | Blocked by keyword | Blocked |
| 1033 | Blocked – subscription level exceeded | Blocked |
| 1034 | Permitted – subscription level exceeded | Permitted |
| 1035 | Password override page | Blocked |
| 1037 | Permitted by password override | Permitted |
| 1040 | Permitted with Confirm option | Permitted |
| 1041 | Blocked – authentication required | Blocked |
| 1042 | Permitted – category not purchased | Permitted |
| 1043 | Permitted by quota | Permitted |
| 1044 | Permitted with keyword match | Permitted |
| 1045 | Blocked due to network bandwidth | Blocked |
| 1046 | Blocked due to protocol bandwidth | Blocked |
| 1047 | File type blocked | Blocked |
| 1048 | File type permitted | Permitted |
| 1049 | Protocol blocked | Blocked |
| 1050 | Protocol permitted | Permitted |
| 1051 | Protocol permitted, not set | Permitted |
| 1052 | Permitted by limited access filter | Permitted |
| 1053 | Redirected by search filtering | Blocked |
| 1054 | Blocked with Confirm option | Blocked |
| 1055 | Blocked by quota | Blocked |
| 1056 | Permitted – protocol not purchased | Permitted |
| 1057 | Blocked by security override | Blocked |
| 1058 | Blocked by Hosted Anti-Virus Scanning - Inbound | Blocked |
| 1059 | Blocked by Hosted Anti-Virus Scanning - Outbound | Blocked |
| 1060 | Permitted by Policy Exception | Permitted |
| 1061 | Blocked by Policy Exception | Blocked |
| 1062 | Permitted by Tunneled Protocol Quota | Permitted |
| 1063 | Permitted by Tunneled Protocol Continue | Permitted |
| 1064 | Blocked by Web DLP | Blocked |
| 1065 | Permitted by Referer | Permitted |
| 1066 | File Blocked: Over Max Scan Size | Blocked |
| 1067 | Cloud app permitted | Permitted |
| 1068 | Cloud app blocked | Blocked |
| 1069 | Protected cloud app request forwarded | Permitted |
| 1281 | Category blocked real time | Blocked |
| 1282 | Category permitted real time | Permitted |
| 1293 | Permitted by password override real time | Permitted |
| 1296 | Permitted with confirm option real time | Permitted |
| 1299 | Permitted by quota real time | Permitted |
| 1301 | Blocked due to network bandwidth real time | Blocked |
| 1302 | Blocked due to protocol bandwidth real time | Blocked |
| 1303 | File type blocked real time | Blocked |
| 1304 | File type permitted real time | Permitted |
| 1310 | Blocked with confirm option real time | Blocked |
| 1311 | Blocked by quota real time | Blocked |
| 1313 | Blocked by security override real time | Blocked |
| 1314 | Blocked Inbound: Cloud Antivirus | Blocked |
| 1315 | Blocked Outbound: Cloud Antivirus | Blocked |
| 1316 | Permitted by Exception: Real Time | Permitted |
| 1317 | Blocked by Exception: Real Time | Blocked |
| 1537 | Permitted by scanning link analysis | Permitted |
| 1538 | Web 2.0 request permitted | Permitted |
| 1539 | Permitted after Web 2.0 scanning and link analysis | Permitted |
| 1553 | Blocked by scanning link analysis | Blocked |
| 1554 | Web 2.0 request blocked | Blocked |
| 1555 | Blocked after Web 2.0 scanning and link analysis | Blocked |
| 1556 | Zipbomb permitted Real Time | Permitted |
| 1557 | Zipbomb blocked Real Time | Blocked |