Traffic log at session start shows a different rule & URL category
Resolution
If traffic log at session 'start' is enabled then there will be logs seen with incorrect security rule.
For example, a general outbound Trust to Untrust allow any application security rule exist (lower in the order)
A rule exists up in the order 'OTS_Allow_Microsoft_Licensing' to allow only selective URLs.
The security rules are scanned from top to bottom.
When the traffic is received, the first security rule in the order will be matched to allow traffic while the firewall is still identifying the correct URL and matching security rule.
The session browser or CLI will show the correct matching rule.
However, the traffic log at 'session start' (pic) will show a non-matching rule. However, keep in mind that the traffic is still not allowed.
The traffic log at 'session end' will show the correct rule which allowed the traffic.