Categories: URL Filtering and Application Control

[ccsjnw]

SmartConsole, doesn't differentiate between categories that can be used for both URL Filtering and Application Control and those that can only be used for URL Filtering or can only be used for Application Control. This can be a little confusing as URL Filtering and Application Control are handled by different blades. It would be a nice visual aid if he categories icon could be coloured coded or differentiate in some other way to make this clearer.

There is also a strange oddity: The description for the DDNS- Dynamic DNS category doesn't define it for use in URL Filtering or Application Control. 

This page only shows the categories that can be used for URL Filtering:

https://usercenter.checkpoint.com/ucapps/urlcat/categories

And the App Wiki only shows how Applications are categorised:

https://appwiki.checkpoint.com/appwikisdb/public.htm

What I struggle with, is trying to find a definitive source of information about when new categories are added. I don't want to know when additional URLs or Applications are added or removed from a category, I just want to know when a new category is added or when a seismic shift in categorisation is made. For example, at some point Marijuana and Illegal drugs were separated, but for many parts of the world Marijuana is still an illegal drug. But I don't know when this re-categorisation happened. 

There are quite a few new categories such as 'Self Harm' - it would be really helpful if there could be a page (like the URL Filtering categories list above), that showed ALL categories, which used a column layout which clearly shows if it is applicable to URL Filtering, Application Control or both, and also shows the date when the category was added. You could also add additional notes to document when large scale re-categorisation events have occurred.

This would be really helpful, and the first place to look when trouble shooting Internet policies.

(please use International date format YYYY-MM-DD - thanks!)

[the_rock · Accepted solution]

I actually posted about something similar while back wondering if there was way to get ALL websites belonging to specific category, but not sure thats possible. Actually, seems that no other vendor can really do that either, which makes sense, as those things change constantly.

[Pedro_Espindola]

It is possible, but no vendor should do that. It takes a huge effort to compile those lists, so making it public would mean giving away intellectual property for free.

[the_rock]

Well...Im not a lawyer by any means, but in my mind, intellectual property always meant something protected by law, which in this case, most likely would not be, since most vendors would have literally, more less, similar websites covered by any given category.

But, I agree, it would be huge amount of work.

[PhoneBoy · Accepted solution]

We have an SK that discusses deprecated categories in App Control: https://support.checkpoint.com/results/sk/sk106783
There's also advice in there about subscribing to the newsletter to get updates on categories.

Unfortunately, I am not aware of anything similar for URL Filtering, nor have I seen a unified list of both sets of categories.

[ccsjnw]

Could an SK article be maintained which just lists when new Categories are added? 
How can this be requested?

To reiterate, I don't want to know about specific URLs or Applications that have been added to existing Categories, I only want to know when new Categories have been added so I can take action in my Internet Policy and decide whether it's appropriate to allow or block that new category. The approach I use for a general Internet Policy is to allow all, and then block by specific categories. However, I didn't know about the addition of the 'Self Harm' category, so I hadn't added it to my block group.

[the_rock]

Real good idea, for sure.

[the_rock]

I even ran this query through fully licensed MS coilot AI and most it gives for SOME categories is about common 100 sites, thats it.

[Chris_Atkinson]

I'm not sure if there is a suitable API endpoint for it currently but one could periodically export the list of Categories from SmartConsole and diff it against the previous / earlier one. 

[PhoneBoy]

There is: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-application-site-categories~v2.... 
The following mgmt_cli command extracts the data in the screenshot (trying to do this with CSV format gives an error):

mgmt_cli -r true show application-site-categories details-level full limit 500 --format json | jq '.objects[] | .name, ."meta-info"."last-modify-time"."iso-8601"'

[ccsjnw]

Unfortunately, the last modified date only shows when the Firewall Manager installation / upgrade was performed, and not when the particular Category was added, which is the information I'm seeking. 

[PhoneBoy]

Right, but it does tell you if one has been added since then as an object would have to be created for it.

[the_rock]

Found a post I had abiyt this almost a year ago, the answer was more less the same...

https://community.checkpoint.com/t5/General-Topics/URL-filtering-query/td-p/242014