NeverIncludeDomain Filter

[ben-sec]

Hello!

I have configured the following domains in the NeverIncludeDomain section of the RITA configuration:

 NeverIncludeDomain:
    - '*.spotify.com'
    - '*.philips.com'
    - '*.qnap.com'
    - '*.windowsupdate.com'
    - 'push.services.mozilla.com'
    - 'autopush.prod.mozaws.net'
    - '*.e-msedge.net'
    - '*.msedge.net'
    - '*.trafficmanager.net'
    - '*.update.microsoft.com'
    - '*.update.microsoft.com.akadns.net'
    - '*.wns.windows.com'
    - '*.webex.com'
    - '*.deploy.static.akamaitechnologies.com'
    - '*.1e100.net'
    - '*.ebaydns.com'
    - '*.googledomains.com'
    - 'blackhole-2.iana.org'
    - 'blackhole-1.iana.org'
    - '*.in-addr-servers.arpa'

But I still get beacon activity for some of them (even though they are SSL connections, e.g. '.update.microsoft.com', '.wns.windows.com'). Is there something wrong with my syntax or why is this whitelisting not working as expected? If my understanding is correct, these filters do only not aply to dns and http logs, correct? Thanks in advance!

Cheers, Ben