Customer was viewing videos on https://central.xero.com and the video content was being loaded from players.brightcove.net which was mis-categorised as Job Search.

Diagnosing this was DNS Filter was impossible.

Luckily I had a Watchguard Firewall onsite and was able to see more detailed log information by filtering based on the endpoints IP Address.

2021-01-18 14:17:13 Allow 192.168.0.35 198.251.86.230 https/tcp 61706 443 0-LAN 0-Telstra ProxyAllow: HTTPS domain name match (HTTPS-proxy-00) Default-HTTPS-Client proc_id="https-proxy" rc="590" msg_id="2CFF-0003" proxy_act="Default-HTTPS-Client" rule_name="Default" sni="players.brightcove.net" cn="" ipaddress="198.251.86.230" Traffic