Web Protection FAQs

In addition to the N-sight RMM (dashboard) URLs and Agent Communication URLs, the Web Protection engine on each device requires access to the URLs available in the Requirements, URLs and Permissions section.

There are two possible reasons why allowed requests may be displayed for a blocked category:

Possible reason 1: Aggregation of data

The Web Protection agent uploads all of the requests from a user's computer which is obviously a lot of data. For storage we aggregate this data by device, day, category and by device, day, website; as displayed in the Web tab, Web Protection Overview Report and Web Protection Report Builder. Although this aggregation of data may cause some confusion in the case of website reporting.

For example if the user visits the URL: www.website123.xyz/malware

Which has a Reputation of High Risk and a Classification as Malware, the request is blocked on the device with the following information uploaded:

Website	www.website123.xyz
Requests	1
Blocks	1
Category	Malware

If the user then visits:www.website123.xyz/sports

Which has a Reputation of Low Risk and a Classification as Sports, the request is allowed on the device with this communicated back to N-sight RMM.

When aggregating this data the existing entry is incremented by one - rather than create a duplicate entry for www.website123.xyz - with the categorization retained from the first visit:

Website	www.website123.xyz
Requests	2
Blocks	1
Category	Malware

As a result of this when viewing the Web tab, Web Protection Overview Report and Web Protection Report Builder there may be instances when not all requests to a website are blocked (in the above example www.website123.xyz). Also in Category based views it may be reported that a specific type of category request was 100% blocked, but some websites that are in this category were not blocked 100% of the time (again from the above this may show Malware requests 100% blocked, but Malware website for example www.website123.xyz/malware as not blocked 100% of the time).

The categorization of a website is only changed in the database where its initial category was Unavailable (below) and as such the reverse of the above is also true, where blocked requests are reported in allowed websites and categories.

Possible reason 2: Web Protection was unable to categorize the URL: Unavailable

If Web Protection is unable to categorize a URL the first time a website is visited, it records the category as Unavailable and allow the user access. If we receive a subsequent request for this site that now contains a category entry, the database is updated to take account of the website's categorization. This can lead to a blocked category reporting less than 100% blocked requests.

This can occur if the block page was cached in the browser. Use Ctrl + F5 to force a hard page refresh.

Websites can belong to multiple categories and this can result in the details for the Categorization sections being greater than those in the Website based view, since one website can potentially create multiple categorization requests.

For example if the user visits www.website123.xyz/games Web Protection may classify this as both News and Video Games. So one request is stored against www.website123.xyz, one request against News and one against Video Games.

If you then total the number of requests under Category in the Web tab or Web Protection Overview Report and Web Protection Report Builder, Download Size, Upload Size, Blocked Requests and Allowed Requests they will all be greater than the sum of the equivalent values from the Website based views.