Hi @masa.oym,
Sorry for the late reply, hope you're doing well! Have you sorted this one yet? I'll add some comments below, but bear in mind I will go over a few things that you will already know about / have already mentioned so that other readers can benefit.
If you are solely using the Protective DNS (PDNS) / DNS Security, the best way to control access to AI content is two methods:
- via Content Categorisation (you are using this already)
- via Application Settings (I imagine you are using this now too)
If you would like to action an explicit block-all for AI-related services, I would recommend blocking the Generative AI content category. This can be done either under 'Policy Components' > 'Content Categories' and editing the content category for the attached DNS Policies you have configured. Alternatively, you can edit the Content Category directly under the DNS Policy. This is suggested because not all AI services have an application signature/entry under Application Settings. Therefore, by skipping this step, there is a high chance that some AI services will still be allowed.
In addition to the above, you can configure your Application Settings so that a default block is in place. A default block means that any applications that Cisco adds in the future will be added to the list and ticked as blocked. This is done by ticking the entire Application Settings category for 'Generative AI'. A 'gear/cog' icon will appear next to the category - ensure it is set to 'Block'. For allowing specific applications, click the 'gear/cog' icon next to the individual application and set it to allow. It is a requirement that all applications are ticked for the dynamic updates to work properly. Shown below is the correct setup to ensure applications are blocked dynamically/immediately as applications become available.
In Umbrella DNS Policies, all allows take precedence over blocks. This means if you configure an application as allowed, it cannot be blocked by anything else, including a destination list block.
In terms of best practices for managing and updating the list, you can use 'App Discovery' from the 'Reporting tab' to review Generative AI applications and add them to the allow list from the same page. Another option is to edit the DNS Policy's attached Application Settings directly through the DNS Policy page. The last method is to modify the Application Settings from the Policy Components. Any of the ways is fine as long as it suits you. Generally, editing from the Policy Components screen is preferred as it carries less risk/opportunity to change the wrong thing than editing the policy directly.
Hopefully this answers your question nicely. If you've any further questions let me know!
