Traffic which should be classified as iOS OS Update is appearing as HTTP instead. This problem can be viewed in Monitor > Real Time
If there is already an application object setup for iOS updates, then this is caused by the Layer 7 signature not working correctly.
By default, here is how the application with this signature is setup:
Since the signature is not working properly, a workaround would be to setup the application differently. Find out the IP addresses which are used for IOS updates, and create a network object with those IPs included. You can then modify the application to be based off of that network object.
Starting in ExOS 6.4.7 and 7.0.3, the Layer 7 signature for iOS updates works properly. Updating to this firmware should resolve the issue.