topic Great. Let us know if you in Network Security

URL filtering events in FMC

Kristian Mattocks — Fri, 21 Feb 2020 14:12:09 GMT

Hi,

I'm looking to investigate some URL events on the FMC, however i can't seem to find a way to get any further information in regards to them, I've tried to search though Analysis and nothing showing in regards to a source IP or the blocked URL.

I've also tried to run a search for "High risk" under the url reputation but it doesn't return any results.

Has anyone else had this issue of trying to find out which users are trying to do things / trigger URL blocks etc?

Thanks

Kris

Only reason you would not see

Dinesh Verma — Fri, 07 Jul 2017 11:22:32 GMT

Only reason you would not see those events with specific search is because there is no such event with those search parameter OR Maybe connections do exist but URL reputation or category is missing.

I would suggest you generate some traffic from a PC for a few websites and verify if you see reputation and category for them (Quick verification).

Adding to what DV adviced,

Jetsy Mathew — Fri, 07 Jul 2017 11:39:36 GMT

Adding to what DV adviced, please make sure that you have enabled logging for the requires rules.

Thank you both for the

Kristian Mattocks — Fri, 07 Jul 2017 13:08:26 GMT

Thank you both for the replies.

Logging is enabled, I've disabled, re-enabled and have redeployed the configuration to the device, I will see if that does anything but i doubt it.

I can see other events and some url stuff but i'm just not getting alot of it which i would expect.

I will continue to have a look around and check if anything looks a miss.

Great. Let us know if you

Dinesh Verma — Mon, 10 Jul 2017 01:25:54 GMT

Great. Let us know if you need any help. If this is something urgent, you can open up a case with us, else we would be glad to assist here.