Hi,

I used HP Web Inspect to scan an online application, using both a custom policy and the standard policy. My custom policy included an check for Cross Site Scripting(No-5649), which is also included in the Standard Policy.

On scanning, Webinspect was able to capture a Threat related to the above category when using the standard policy. But it did not capture any threat when I used the custom policy in same scan.(even though it had gone through the same urls both the time)

I have used the threat no 5649 just as an example. I am facing this issue for multiple threats.

Can anybody please help me out with this?

Thanks