topic Re: URL Category Block Alert in General Topics

URL Category Block Alert

DPoppleton — Mon, 30 Oct 2017 16:24:53 GMT

With the addition of the Command-and-Control URL category, I would love to get an alert any time someone hits that category so we can remediate the problem PC. I just can't for the life of me figure out how to set that up. I don't want all URL category blocks sending alerts, just this one. Before I pull my hair out trying to figure out how to do it I figured I would ask all you smart folks here. Is this even possible?

Re: URL Category Block Alert

BPry — Mon, 30 Oct 2017 18:35:30 GMT

@DPoppleton,

Are you running 8.0.*?

If you go into Log Forwarding you could actually add this pretty easily. Create a new profile match list that specifies the log type as URL, then in the filter simply specify ( category eq command-and-control ). The end result would essentially just be a new match list that looks like below, then this should function fine.

Re: URL Category Block Alert

DPoppleton — Mon, 30 Oct 2017 18:57:32 GMT

I'm running 7.1.7.

Re: URL Category Block Alert

BPry — Mon, 30 Oct 2017 19:01:30 GMT

I don't think you'll have that as an option then until you move up to 8.0. Depending on your security policy structure you could put a policy above your current browsing policy that specifies that command-and-control traffic gets blocked and put a log-forwarding policy that alerts on URL actions specifically on this new rule.