URL Category/Category List block and allow behaviors

[jsalmans]

I'm having an interesting issue where I've set up block action on almost all of the URL categories on a specific filtering list, including the risk categories.  I've allowed three specific categories such as education, computer and info, and training and tools.

Looking at the logs, I'm still seeing blocks.  What I've noticed is the main category being presented for the websites in the logs is low-risk.  The education, computer/info, etc. are being shown in the category list but not the main category that it seems to be actioning off of.  I'm assuming it is blocking because it is matching the low-risk category regardless if the other allowed category is matched such as the education one?

Do the risk categories work differently than the others in some way?  If I allow low-risk, will that act as an "and" to match with the other allowed category types?  I didn't want to allow it and it act as an "or" where something like an adult website is suddenly allowed because it would match the low-risk regardless of whether the adult category is allowed.

Thanks!

[PavelK · Accepted solution]

Hello @jsalmans

to me it looks like this is expected. This is a multi category match where the most sever action takes precedence. If you set low-risk security category to block and computer info category to alert, then the URL matching these categories will be blocked because block action in security category has more stricter action. Details are in this KB: Risk Category Appears Instead of Valid Category Under URL Filtering Log.

Kind Regards

Pavel

[jsalmans]

Hi @PavelK 

Thank you for that link.. I was doing some searching earlier and hadn't found that one.

Based on that, I do agree it is working as expected.  It seems a bit odd to me that the risk levels are included as categories since, on the URL Check website, they're clearly labeled as risk levels and separate from the category listed.  It almost seems like they should design that differently where the risk levels are assessed but in a different section so that they don't really conflict with the URL categories.

As a workaround, I've made several new URL categories... one that matches education and low-risk, another that matches computer-and-info and low-risk, etc.  So it is matching if both of those are present.

I'm sure the other way to do it would be to allow those categories and the low-risk as well.. my worry was if I came across a website that is only categorized as low-risk but nothing else in which case it would have been allowed.  That being said, I'm not sure I've come across any websites like that and I wonder if I ever would because, again, on the URL Check page it very much seems like every website should have both a risk level and then one or more URL categories.

Thanks!