URL Category - Real time detection

[Schneur_Feldman]

Can anyone explain what is the Real Time detection URL category? And what it does?

[OtakarKlier]

Hello,

The definition is:

Detects New and Unknown Malicious Web-Based Attacks in real-time. This is a feature of Advanced URL Filtering.

Here is a link to the white paper describing it.

https://live.paloaltonetworks.com/t5/blogs/new-url-filtering-category-real-time-detection/ba-p/39368...

Regards,

[Schneur_Feldman]

So should I block it? Or set it to allow? 

Also, what does the Encrypted DNS block?

[DavePalo]

Recommendation is to block Real Time Detection and Encrypted DNS

Blocking Encrypted DNS stops DNS over HTTPS, forcing your clients to revert to regular DNS that the Palo Alto can see.

Please see blog on Encrypted DNS below for more info:

New Advanced URL Filtering Category: Encrypted-DNS | Palo Alto Networks

[OtakarKlier · Accepted solution]

Hello,

I would say block it. Here you can watch a video I made for secure DNS. You can use any provider for secure DNS.

https://www.youtube.com/watch?v=ROIAYSEbTuo

Regards,