Manual client proxy configuration requires the appliance to operate in forward proxy mode.
Setting IP spoofing connection type to explicit supports explicitly proxied client connections while preserving the intended source identity handling for those proxy sessions.

In an explicit forward proxy deployment, endpoint browsers must be configured to send HTTP and HTTPS requests to the Cisco Secure Web Appliance. A PAC file provides the browser with proxy-selection instructions so web traffic is directed through the appliance.

Cisco Secure Endpoint file reputation scanning uses TCP port 32137 by default to communicate with the file reputation service for malware analysis and verdict lookup.

The log shows the request was denied by AVC policy due to the detected application classification under Presentation / Conferencing. Setting that application type to Monitor permits access while still logging and tracking the activity.

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-5/user_guide/b_WSA_UserGuide_11_5_1/ b_WSA_UserGuide_11_5_1_chapter_0100.html#task_1214899