Hi everyone,
I'm starting to find a few limitations in the Sophos central endpoint web filtering.
Is there any way to find out if a url is in a particular web category when using sophos central?
Also could sophos central report on all web browsing so I can see which sites users have been accessing most frequently. Or even a report where i can find out if any of our users have accessed a particualr site?
thanks in advance
Richard
Hi Richard Hamblin ,
Thank you for reaching out to the Community Forum.
You can put websites into your own custom categories through Website Management, you can view the custom categories that you've set there. But if you need to check if a URL is in a particular Sophos' default website categorization, this is currently not feasible in Sophos Central. The most efficient way to do this is to use the Sophos Intelix tool.
In the Sophos Central Logs & Reports, it’ll only show the list of blocked & warned sites or the policy violators. If you need a list of all web browsing or find out if a user accessed a specific site, this is also possible through Live Discover, if you have an XDR license.
We have different queries already available that might help you generate the reports that you need:
Hi Richard,
I've tested this on my end, and this specific query does not display any details. I'll confirm this with our internal team and update this thread as soon as I have more details.
In parallel, there's also another default query available, which is the "URLs accessed on Windows (Data Lake)" under Data Lake Query. You'll need to ensure that you have turned on the data lake upload on your central to fetch the data from your devices.
For other custom queries, you may also refer to our dedicated Live Discover & Response Query Forum.
Hi Richard,
I've tested this on my end, and this specific query does not display any details. I'll confirm this with our internal team and update this thread as soon as I have more details.
In parallel, there's also another default query available, which is the "URLs accessed on Windows (Data Lake)" under Data Lake Query. You'll need to ensure that you have turned on the data lake upload on your central to fetch the data from your devices.
For other custom queries, you may also refer to our dedicated Live Discover & Response Query Forum.
Hi Richard Hamblin ,
I apologize for the confusion. I've confirmed this with our internal team; we do not have this as a default query. There's no query available in our schema table for browser histories yet. It looks like someone had created a custom query with the name, hence it appears on my end, but there's no details associated with it.
You can make use of the Data Lake Query mentioned above, but if you need assistance creating a custom query, I suggest getting some help from our Live Discover & Response Query Forum.
