With any other rule, if I click on "apps seen" a windows pops open called "Applications & Usage" and from there I can see all the applications hitting that particular rule. Great, until it isn't.
With the two default rules intrazone-default and interzone-default, I see "apps seen" with a number, but when I click on it, nothing pops up showing me the "Applications & Usage".
I thought at first I have to maybe override it, nope, if you do that the number goes away.
Is this like this for everyone or just me? Is there a way to see "apps seen" via CLI?
If you try to add an exception from the threat log for a profile that is used in the default intra/inter rules, the exception will not display which profile is used :p
I have the same behavior. Not sure if this is "by design" or an oversight If you set up your own drop-all + intrazones you'll get the I fo you want though ;) (I bet that's the official stance too)