topic Re: URL filtering in PAN-OS5 in General Topics

URL filtering in PAN-OS5

LCMember2860 — Thu, 22 Nov 2012 14:42:15 GMT

Is there any information on this anywhere (ie the new PAN database, not Brightcloud)

Is there a list of categories, and how do they map onto the Brightcloud categories?

How can I lookup what category a URL is in, and request a change if required?

Re: URL filtering in PAN-OS5

dyang — Thu, 22 Nov 2012 18:02:38 GMT

Hello,

We should have a FAQ posted soon, but for detailed information, please contact your SE or account rep. In the meantime, you can find a list of PAN-DB categories and their descriptions here:

urlfiltering.paloaltonetworks.com/CategoryList.aspx

For BrightCloud to PAN-DB category mapping:

BrightCloud to PAN-DB Category Mapping

To test a URL and submit a change request:

urlfiltering.paloaltonetworks.com/testASite.aspx

Thanks,

Doris

Re: URL filtering in PAN-OS5

LCMember2860 — Tue, 27 Nov 2012 10:53:29 GMT

Thanks Doris.

There's fewer categories in PAN's database (59 vs 73 for Brightcloud). Mostly this is because Brightcloud have multiple categories for Malware and IT, but the one that jumps out is "Cult and Occult" for which there is no equivalent in PAN's database.

We have this category blocked, I suspect many other educational implementations also have it blocked and we can't just block the "Religion" category. (I'd also note that Fortinet and Websense both have equivalent categories). Example URL: churchofsatan.com - philosophically one might argue that all religions are cults by definition, but school boards tend not to see it that way . Needs to be addressed before we could even consider migrating from Brightcloud to PAN (which I assume is what you want everyone to do eventually).

Re: URL filtering in PAN-OS5

mikand — Tue, 27 Nov 2012 14:02:19 GMT

What would be interresting, now when PA have their own db, is the possibility of sub-categories?

For example now when adware is being bundled together with other types of malware.

I mean its not bad to completely block category malware, but what if you just want to block adware/ads and nothing more?

I think the situation is similar to if you wish to block one kind of ocult (searchofsatan.com) but not the other kind of ocult (the vatikan homepage or whatever 🙂