Prisma Access - Explicit proxy takes the action 'Sinkhole' even though another option is specified in the anti-spyware profile created by the customer

The action "block" is selected for Command and Control Domains or Malware Domains under the DNS security setting in the anti-spyware profile.



However, they see the DNS traffic is processed as Sinkhole in Threat log.



In Remote Networks or Mobile Users, the same DNS query is processed by the action as specified in the anti-spyware profile.

• Prisma Access
• Explicit Proxy
• DNS Security

• Action for Malware and C2 categories is set to Sinkhole in Explicit Proxy.
• Sinkhole is selected over Block action because we want to prevent retries from malicious scripts.

This behavior is as designed and expected, and there is no workaround when using Explicit Proxy.