URL Filter exemption applied to the domain that is not in URL filter list

[AtiT]

Hello,

I am facing a problem on two FortiGates, one on OS 5.6.2 and another on OS 5.6.3.

The customer has blocked some Webfilter categories like Bandwidth Consuming, Freeware Download etc. He called that he need to allow one domain from these categories. I created a custom Category called Company Allowed Domains and created a Web Rating Override to this local category.

I can see in the logs, that the domain was blocked earlier. After a recategorization the domain was allowed as Category but the other matches shows that URL Filter allowed the connection.

Why it is that? I do not have this domain in the URL Filter List. I should only see that category was allowed and not URL.

Only certificate inspection is used, not deep inspection.

See the attached image.