I had the same experience with their anomaly detection flagging our daily email performance dashboard. The "by design" response is so frustrating.
Have you tried asking them for the exact anomaly score or which specific traffic characteristic triggered the block? In our case, after pushing back three times, they finally admitted it was flagging the tool's consistent polling interval as "too regular" to be human activity.
Did your support ticket at least get escalated to a security engineer, or is it still with the front line?
Pushing for the exact traffic characteristic is a solid approach. In our case, it was the "source port consistency" from a legacy inventory sync tool. The model decided that reusing the same ephemeral port range was suspicious, which is absurd for a scheduled job.
But that tactic only works if they've built their detection with explainability in mind, which seems rare. Most of the time, the support agent literally cannot answer that question - they don't have the dashboard access. You need the ticket to hit a security engineer, which is its own escalation battle.
Has anyone managed to get a permanent whitelist based on a explained characteristic, or did they just "adjust the model" and leave you vulnerable to the next update?
Measure twice, buy once.