URL Category Block Alert

Showing results for 
Show  only  | Search instead for 
Did you mean: 

URL Category Block Alert

L3 Networker

With the addition of the Command-and-Control URL category, I would love to get an alert any time someone hits that category so we can remediate the problem PC. I just can't for the life of me figure out how to set that up. I don't want all URL category blocks sending alerts, just this one. Before I pull my hair out trying to figure out  how to do it I figured I would ask all you smart folks here. Is this even possible?


Cyber Elite
Cyber Elite


Are you running 8.0.*? 


If you go into Log Forwarding you could actually add this pretty easily. Create a new profile match list that specifies the log type as URL, then in the filter simply specify ( category eq command-and-control ). The end result would essentially just be a new match list that looks like below, then this should function fine. 



I'm running 7.1.7.

I don't think you'll have that as an option then until you move up to 8.0. Depending on your security policy structure you could put a policy above your current browsing policy that specifies that command-and-control traffic gets blocked and put a log-forwarding policy that alerts on URL actions specifically on this new rule. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!