Classified apps are based on various parameter, usually unique port(s) used by a particular service or a list of know servers that are utilized. If the UTM doesn't have those definition parameters, because the app uses dynamic/non-unique ports or is constantly changing servers, the app shows as unclassified. Hit the various reports under logging and reporting to find the port(s) used, the remote server address, and the address of your client machine. You can then use a combination of your knowledge of what's installed on your client machine, the data in the reports and logs on the UTM, google searches, and whois lookups/nslookups to possibly track things down one by one.
↧