MX, how can we know users have access to unsecured websites?

[Natthaphol]

Dear all,

How can we know users have access to unsecured websites? Let's say that we do not block any categories in Content Filtering.

Thank you,

Natthaphol.

[DarrenOC]

If you’re not blocking anything, either via content filtering or other methods, then your users have access to everything!

[Natthaphol]

Understand, what if customer do not block anything and their users have accessed the know threat sites. Is there any report or information that the admin can verify?

[CptnCrnch]

What exactly is meant by "unsecured websites"? Sites without SSL- / TLS decryption?

[Natthaphol]

Hacker, Malware, Spyware, Social Engineering, Bot, Ransomeware, etc. Websites.

[CptnCrnch]

You'd see these only when actually blocking the connection.

I don't think there's an easy option for that. You could theoretically send URL events via Syslog (https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_...), parse these URLs and parse TALOS reputation center (https://talosintelligence.com/reputation_center/) for the resulting category. Don't know if they'd block access if used extensively though. 🙂