Capture ATP and CDN's

Simon_Weel

Our company provides building engineering services for a variety of clients. To make files accessible for all building partners, the different parties use different platforms. There's Box, Wetransfer, Viadesk, Google Drive and the latest uses MS Teams. Thing is - all those services drop their files off at some CDN like Amazon. Although all partners have their own portal with their own domain name, when it comes to downloading files, the're pulled from those CDN's. And that's where Capture ATP kicks in. I've set it to "Block until verdict", which for bigger files means lots of timer the browser aborts the download due to a network error. The person downloading has to click the Resume button to restart the download. And has to do so frequently, which is bothersome.

Creating an exception for such a service doesn't work. For example, if a partner uses MS Sharepoint and has it's own portal like "buildingabc.sharepoint.com" and you add that domain name to the list of exceptions, files downloaded from that particular domain are actually downloaded from "westeurope1-mediap.svc.ms" and as such are NOT excluded from Capture ATP.

Since them files are all piled up on a single location, there's bound to be some people dropping malicious files on those services / CDN's as well. So I'm not willing to create an exception for, in this case, "westeurope1-mediap.svc.ms".

This is getting more and more of a problem? So I wonder how I can exclude from Capture ATP only the downloads from our partners?