Blue Coat File Reputation consists of four indicators as below,
1. Blue Coat File Reputation Service Presented File Extensions
2. Blue Coat File Reputation Service Presented MIME Types
3. Blue Coat File Reputation Service File Types
4. File Transfer Activity
To exclude the specific IP, you are required to make changes to all the above four of the indicators so that the IP address will be excluded. A sample screenshot is show below for IP exclusion on 'Blue Coat File Reputation Service Presented File Extensions' for IP address 10.0.0.1.
Adding additional indicators with the IP exclusion filter to FRS rules will not help as the method uses the OR condition in the indicators instead of the AND condition. If a flow matches ‘Blue Coat File Reputation Service Presented File Extensions’ OR ‘Blue Coat File Reputation Service Presented MIME Types’ OR ‘Blue Coat File Reputation Service File Types’ OR ‘File Transfer Activity’ OR ‘IP Exclusion’, it will be sent to File Reputation Service.