Help with Umbrella Blocking

[scisco]

We turned on content monitoring and have blocked all the listed (by Talos) cloud storage websites, but now we are seeing users finding lesser known storage websites to get around the Talos list. Is there a proactive way to handle this? We only recently found out by looking at the log of websites visited by users on our network.

[Konstantinos9]

Hi,

For sites that appear not to be categorized or not properly categorized, you can open a support ticket and ask for the domain to be investigated and categorized. You may also use the Block Lists to block those domains.

Another option, since you can find these domains in the reports, would be to try using the Application control. Have you enabled Application control? and if yes, have you checked if those services appear under cloud storage or a similar category? Blocking the category from application control could be what you're looking for.

Both for content categories and application control, I would suggest also to review some similar categories, like "file transfer" etc.

Let me know if the above is helpful.

Thanks

Konstantinos

[scisco]

We currently have the content category enabled to block file transfer websites (enforcing the list of websites in umbrella). If a website is not categorized or tagged on this list we are struggling to block this.

Just to clarify when you say using the application control. Are you saying the website the user visits would also show up in the application log as a potential file service category? Think I'm a bit confused here. Could you give me a very simple example of how this would work?

[Aref Alsouqi]

Or another option would be to use the allow only mode on Umbrella. What this basically does is blocking everything with the exception for whatever you allow. It is kinda the way around of what you are doing right now.

[scisco]

Is allow only mode the same as blocking newly seen websites feature? Basically block everything and then we determine exceptions