URL Content Filtering Alerts

SOLVED
Firewall72
New here

URL Content Filtering Alerts

Hi,

 

Unless I missed something, it doesn't appear email alerts are included with URL Content Filtering.  I'm simply looking to send an email alert when a URL is blocked.  I can see them in the MX Event Log, so I perhaps Syslog is a workaround but I was hoping to accomplish this within the Meraki software.  

 

Thank you.

 

John

1 ACCEPTED SOLUTION
BrandonS
Kind of a big deal

I can suggest https://papertrailapp.com as a cloud syslog server.  It has a free tier and is also easy to create email, SMS and web hook alerts for anything you want.

- Ex community all-star (⌐⊙_⊙)

View solution in original post

8 REPLIES 8
jdsilva
Kind of a big deal

Email alerts for content filtering aren't available AFAIK.  You might have to go the Syslog route. 

DJDonovan
Meraki Alumni (Retired)
Meraki Alumni (Retired)

For content filtering events, Syslog is what you want. In terms of scaling, one email alert per content filter block can get out of hand quickly depending on the size of your user base, as well as their inclination to try and reach blocked categories. 

 

We do have email alerts for Malware that you can set due to the severity of that type of traffic. 

~~If you found this post helpful, please give it kudos. If my answer solved your problem, click "accept as solution" so that others can benefit from it.~~

The Meraki ECMS exam is now live! Test your knowledge of Meraki and become an official Cisco Meraki Solutions Specialist. More info on the ECMS exam found here.

For information regarding all of Meraki's training offerings, be sure to check out the Meraki Learning Hub.

Thanks, but other solutions use digests and other controls to address scaling.  To be honest, it feels like a basic feature is missing.  Thank you.

@Firewall72  you probably don't want an email everytime content filtering blocks something.  Your email will be filled up with events that you can do nothing about.

 

You are probably better going Organisation/Security Centre, and then schedule the report to be emailed to you (in the top right hander corner).  At least you can get a nice summary then.  You can even do it daily if you really want to.

Thank you, but in my Security Center I only see options for Malware and IDS.  Should I also see Content Filter for URL Blocking?  Also, it's worth noting that I'm only blocking on a small number of categories and I'm lucky to see 1-5 blocks per week.  So I get where everyone is coming from, but it really depends on the environment and config.

jdsilva
Kind of a big deal

Oh hey, maybe the Summary Reports will work for you?

 

Under Organization > Monitor > Summary report you can view the summary report for your MX network. In that report is the Top N blocked sites shown a few different ways:

 

image.png

You can set these reports up to be emailed to you every day/week/month etc. It's not real-time alerting to blocked URLs, but you can see every day what was blocked the previous day in an email to your inbox. 

BrandonS
Kind of a big deal

I can suggest https://papertrailapp.com as a cloud syslog server.  It has a free tier and is also easy to create email, SMS and web hook alerts for anything you want.

- Ex community all-star (⌐⊙_⊙)

Thanks Brandon.  I have that a try and it works quite well.  I'm hoping Meraki adds this as a default alert option soon.  Thanks again!

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels