Advanced IoT Protection (AIP) uses machine learning on device network metadata to establish known behaviors. However, sometimes safe sites can be flagged as a false positive If a new behavior comes across our large training samples or if device behaviors are updated by the vendor, the device may be incorrectly flagged. Learning happens continually to establish new normal behaviors, however can cause some alerts in the interim. If you trust the website the device is accessing you can whitelist it for the device and for all devices in the home. 

When an anomaly is detected, the device will automatically be placed into quarantine to protect the integrity of your network and the devices connected to it. Quarantining the device effectively places "Internet Only" permission on the device, allowing basic functionality.

To unquarantine a device:

1. Find the affected device, highlighted in red

2. Tap on the "Device is quarantined" banner

3. Users can choose to unquarantine for 1 hour or permanently

To learn more about the blocked activity, see How can I tell what events have been blocked by Online Protection?