URL Category Block Alert

[DPoppleton]

With the addition of the Command-and-Control URL category, I would love to get an alert any time someone hits that category so we can remediate the problem PC. I just can't for the life of me figure out how to set that up. I don't want all URL category blocks sending alerts, just this one. Before I pull my hair out trying to figure out  how to do it I figured I would ask all you smart folks here. Is this even possible?

[BPry]

@DPoppleton,

Are you running 8.0.*? 

If you go into Log Forwarding you could actually add this pretty easily. Create a new profile match list that specifies the log type as URL, then in the filter simply specify ( category eq command-and-control ). The end result would essentially just be a new match list that looks like below, then this should function fine. 

[DPoppleton]

I'm running 7.1.7.

[BPry]

I don't think you'll have that as an option then until you move up to 8.0. Depending on your security policy structure you could put a policy above your current browsing policy that specifies that command-and-control traffic gets blocked and put a log-forwarding policy that alerts on URL actions specifically on this new rule.