URL Filtering Categorisation Justification

[MikeMeredith]

Hi!

We're running URL filtering on our PanOS campus firewalls and I very often get asked to add domains to our 'allow list' - almost always because they're newly registered domains. On occasions we've had sites requested that fit into more serious categories - the latest being 'grayware'. These are very often personal web sites used for teaching and not intended to be malicious in any way. 

It would be very helpful if the reasons for categorisation could be made available - for example the website owner of the 'grayware' site above is quite willing to fix any issues with their site but doesn't know what's wrong with it. 

[anuj_mor]

You can log a ticket with TAC and ask for justification and possibly request for recategorization. Unfortunately, these process are like a black box for customers since it is all managed by Palo backend teams (like Unit42)

[Raido_Rattameister]

You might consider changing "newly registered domains" action from "block" to "continue" to allow site access if user action is involved.

For incorrectly categorized domain ask users to request recategorization at https://urlfiltering.paloaltonetworks.com/

[MikeMeredith]

Hi!

Thanks for the suggestion although that would seem to reduce security somewhat. Although it would be handy to be able to 'tweak' the countdown from 32 days to 7 days.

We actually have an improved method for dealing with newly-registered-domains - we have a database driven EDL adapted from our existing IP block/allow lists. The question is really more about other riskier categories - where we're not willing to add to the allowlist without additional information.

[Raido_Rattameister]

Main issue with newly-registered-domains is malware that generates domain names using algorithm and then connects to them behind user's back.

Having continue page will block this kind of malware calling home. In case of users continue page can warn them that it is possible security risk etc.

Also you can run reports against URL log where users bypassed this page.