Before
Support staff had to look up the requested domain in the web gateway and reputation service separately, interpret the findings, and decide whether the exception could proceed. They also had to document the evidence in the service request and perform the allowlist update and closure steps.
How it works
- Receive the URL exception and retrieve its gateway classification and reputation evidence.
- Reject malicious domains, escalate suspicious findings to Security Operations, or continue when the evidence is clean.
- Add clean domains to the allowed category, activate the configuration, and update or close the service request.
Workflow details
- Request intake: A webhook receives a URL exception request containing the domain and service request details.
- Reputation checks: The workflow retrieves the domain’s existing web gateway classification and checks its reputation evidence, including malicious and suspicious findings.
- Automated decisions: Domains with malicious findings are rejected and documented in the service request, while domains with suspicious findings are escalated to Security Operations for validation before any allowlist change.
- Allowlist update: A domain that passes the automated checks is added to the designated allowed business-sites category, and the configuration is activated.
- Ticket closure: Approved requests are closed with the applied change, activation status, reputation result, and original classification recorded in the request.
What changed
Every request now follows an automatic decision path: malicious domains are rejected, suspicious domains are routed to Security Operations for human validation, and clean domains are added, activated, documented, and closed without the same manual handoffs.
Work removed
Repeatedly searching for the same domain in two security services, comparing malicious and suspicious findings, copying classification and reputation evidence into the request, manually updating the allowed category, activating the configuration, and closing approved requests.
Expected outcome
A consistent recorded decision for each URL exception, with two recurring reputation lookups and the related evidence-copying steps removed per request.
