URL Content Filtering Alerts

[Firewall72]

Hi,

Unless I missed something, it doesn't appear email alerts are included with URL Content Filtering.  I'm simply looking to send an email alert when a URL is blocked.  I can see them in the MX Event Log, so I perhaps Syslog is a workaround but I was hoping to accomplish this within the Meraki software.  

Thank you.

John

[jdsilva]

Email alerts for content filtering aren't available AFAIK.  You might have to go the Syslog route. 

[DJDonovan]

For content filtering events, Syslog is what you want. In terms of scaling, one email alert per content filter block can get out of hand quickly depending on the size of your user base, as well as their inclination to try and reach blocked categories. 

We do have email alerts for Malware that you can set due to the severity of that type of traffic. 

[Firewall72]

Thanks, but other solutions use digests and other controls to address scaling.  To be honest, it feels like a basic feature is missing.  Thank you.

[PhilipDAth]

@Firewall72  you probably don't want an email everytime content filtering blocks something.  Your email will be filled up with events that you can do nothing about.

You are probably better going Organisation/Security Centre, and then schedule the report to be emailed to you (in the top right hander corner).  At least you can get a nice summary then.  You can even do it daily if you really want to.

[Firewall72]

Thank you, but in my Security Center I only see options for Malware and IDS.  Should I also see Content Filter for URL Blocking?  Also, it's worth noting that I'm only blocking on a small number of categories and I'm lucky to see 1-5 blocks per week.  So I get where everyone is coming from, but it really depends on the environment and config.

[jdsilva]

Oh hey, maybe the Summary Reports will work for you?

Under Organization > Monitor > Summary report you can view the summary report for your MX network. In that report is the Top N blocked sites shown a few different ways:

You can set these reports up to be emailed to you every day/week/month etc. It's not real-time alerting to blocked URLs, but you can see every day what was blocked the previous day in an email to your inbox. 

[BrandonS · Accepted solution]

I can suggest https://papertrailapp.com as a cloud syslog server.  It has a free tier and is also easy to create email, SMS and web hook alerts for anything you want.

[Firewall72]

Thanks Brandon.  I have that a try and it works quite well.  I'm hoping Meraki adds this as a default alert option soon.  Thanks again!