URL FILTERING

WITH PAN-DB
Enable Safe Web Access for All Users

URL Filtering with PAN-DB enables safe web access, protecting

users from dangerous websites, malware sites, credential-phishing
pages and attacks attempting to leverage web browsing to deliver
threats. The service is a native component of the Next-Generation
Security Platform, providing best-in-class security without adding
operational burden.

URL Filtering with PAN-DB: The web is one of the most common they have insufficient application
• Prevent attacks that leverage attack vectors for threat delivery, visibility, can’t coordinate action, and
the web as an attack vector, exposing organizations to security lack meaningful integration with other
including phishing links in risks, including malware propagation, network defense systems to protect
emails, phishing sites, HTTP- credential theft and data loss. URL against the different attack stages and
based command and control, filtering is a crucial component of threat vectors.
malware sites, and pages that an organization’s threat prevention
Controlling web application activity
carry exploit kits. strategy.
requires a natively integrated approach
• Automated updates for newly The web can be a dangerous place. that implements rules for web browsing
discovered attacks with updates Uncontrolled web surfing or email as a natural extension of existing network
from the Palo Alto Networks® link clicking can quickly lead to a traffic policy, enabling control of web
WildFire™ cloud-based threat security incident. Stand-alone URL browsing activity and any inherent threats,
analysis service every five filtering solutions don’t have the right including applications commonly used
minutes, blocking malicious mechanisms to adequately control web to bypass traditional security mechanisms.
URLs as they are discovered. browsing or prevent threats because

• Enable SSL decryption with

granular policy that balances
the inspection of potentially
harmful content, while allowing Applications URLs Known Threats Unknown Threats
sites with sensitive, personal • Identify and control all • Control traffic sources • Stop exploits, malware, • Automatically identify

information to remain encrypted. applications, across all

ports, all the time.
and destinations based spying tools, and
dangerous files.
and block new and
evolving threats.
on risk
• Enable granular policy control
for web browsing activity as an
extension of your application-
based policies.
• Maintain web performance by
combining fast cloud URL lookups
with a local cache to ensure
rapid web browsing while
increasing the accuracy and
relevancy of categorization.

Palo Alto Networks | URL Filtering Datasheet 1

 Coordinated Protection Across the allowing for precise exception-based the User-ID™ user identification
Attack Lifecycle behavior, simplified management, and technology capabilities of the Next-
PAN-DB works as part of Palo Alto the flexibility to granularly control web Generation Firewall, PAN-DB detects
Networks Next-Generation Security traffic through a single policy table. user credentials submitted into outgoing
Platform to provide an integrated Examples of how URL categories can web forms, and enables policy to be
approach to stopping threats at every be used in policies include: set that can block the attempt, allow
opportunity. Policies, traffic, threat it, or notify the user they may be
• Prevent file download/upload for URL
logs and protections are automatically undertaking a dangerous action.
categories that represent higher risk
coordinated to stop attacks before (e.g., allow access to personal email,
compromise occurs. Selectively Decrypt Web Traffic
but prevent upload/download of
executable files or other potentially Establish policies to selectively
Palo Alto Networks Next-Generation
dangerous file types from such sites decrypt SSL secured web traffic to
Firewall (NGFW) natively classifies all
to limit malware propagation). gain maximum visibility into potential
traffic by application, including web
threats while complying with data
applications, and ties that traffic to the • Identify and allow exceptions to privacy regulations. Specific URL
user, regardless of physical location general security policies for users who categories, such as social networking,
or IP address, and then inspects all may belong to specific groups within web-based email or content delivery
allowed traffic and web content for Active Directory® (e.g., deny access networks, can be designated for SSL
threats. The application, content and to hacking sites for all users, yet allow decryption, while transactions to
user — the business elements that run access to users who belong to the and from such sites as government,
your organization — are then used as security group). banking institutions or healthcare
the basis of all security policies. By
• Allow access to personal websites providers can be designated to remain
addressing traffic visibility and control
and blogs, but decrypt if SSL is used, encrypted. Selective decryption
from both the application and web
and employ strict Threat Prevention enables optimal security posture
content perspective, your organization
profiles to block potential exploit kits while respecting confidential traffic
is safeguarded from a full spectrum of
embedded in forums and posts. parameters set by company policies
regulatory, compliance, appropriate
or external regulations.
use and security risks.
Prevent Credential Phishing
Palo Alto Networks URL Filtering Attempts Tighten Controls Over Common
subscription service, PAN-DB, Policy Evasion Tactics
Phishing attacks are some of the most
provides secure web browsing and URL URL Filtering policies can be enforced
prevalent, dangerous and malicious
access by allowing administrators to even when common evasion tactics,
techniques available to adversaries
block dangerous sites that deliver such as cached results and language
aiming to steal legitimate user credentials.
malware, attempt to circumvent translation sites, are used.
When stolen, genuine credentials
security controls, or are designed to
provide attackers with “authorized” • Search engine-cached results
steal legitimate user credentials. When
access to the network, which is prevention: A common tactic to
an attack is launched against your
less likely to trip any alarms or alert evade controls is to access cached
network, URL Filtering works with
administrators, which, in turn, means results within the popular search
your NGFW and Threat Prevention
more time for attackers to accomplish engines. URL Filtering policies are
subscription to provide additional
their objectives, potentially stealing applied to cached results when end
blocking capabilities. In addition to
sensitive information or causing harm users attempt to view the cached
its own analysis, PAN-DB utilizes
to an organization. results of Google ® search and
information from WildFire, updating
PAN-DB protections for malicious PAN-DB analyzes potential credential internet archive.
sites every five minutes. phishing attempts through static and • Translation site filtering: URL Filtering
dynamic analysis, as well as advanced policies are applied to URLs that are
Extend Firewall Policy to Control machine learning models, conclusively entered into translation sites, such
Web Content identifying and preventing them as Google Translate, as a means of
As an extension to the application through the “phishing” URL category. bypassing policies.
visibility and control enabled by Additionally, the PAN-DB phishing
App-ID™ application identification category is informed about indicators Safe Search Enforcement
technology, URL categories can be of compromise from a variety of
sources, including third-party feeds; Safe Search Enforcement allows you
used as match criteria for web traffic to prevent inappropriate content from
within your firewall policies. When Unit 42, the Palo Alto Networks threat
research team; and WildFire. appearing in users’ search results.
web traffic is seen, your NGFW, with When this feature is enabled, only
the help of PAN-DB, identifies the URL Beyond identifying and preventing Google, Yahoo® or Bing searches with
category and applies policy just as it potential credential phishing threats the strictest safe search option set
does for all other application traffic. from being delivered to users, PAN-DB will be allowed; all other searches can
Instead of creating rules that are limited offers unique capabilities to prevent be blocked.
to either allowing all or blocking all credentials from being unwittingly
web behavior, the URL category acts sent to adversaries by users. Leveraging
as a granular matching mechanism,

Palo Alto Networks | URL Filtering Datasheet 2

 Customizable URL Database and URL Activity Reporting and Logging Cost-Effective Deployment
Categories A set of predefined or fully customized Because URL Filtering with PAN-DB
To account for each organization’s URL Filtering reports provides IT is enabled as a natively integrated
unique traffic patterns, on-device departments with visibility into URL subscription on the Palo Alto Networks
caches are used to store the most Filtering and related web activity Next-Generation Security Platform,
recently accessed URLs. Devices also including: it provides a scalable answer to
automatically query a master cloud- deploying secure web gateway
• User activity reports: An individual
based database for URL category functionality directly within your
user activity report shows applications
information when a URL is found that existing network traffic policy. This
used, URL categories visited, websites
is not in the cache already. Lookup architecture provides protection from
visited, and a detailed report of all
results are automatically inserted into web-borne threats that is automatically
URLs visited over a specified period
the cache for future activity. Additionally, coordinated with our other prevention
of time.
administrators can create custom URL technologies to block threats at every
categories to suit their specific needs • URL activity reports: A variety of top opportunity.
or to create specific categorizations for 50 reports that display URL categories
The unlimited user license behind
internally hosted websites or domains. visited, URL users, websites visited,
each URL Filtering subscription and
blocked categories, blocked users,
the high-performance nature of the
Customizable End-User Notification blocked sites and more.
Palo Alto Networks Next-Generation
Each organization has different • Real-time logging: Logs can be Firewall means that customers can
requirements on how best to inform filtered through the easy-to-use log secure web activity for an entire user
end users that they are attempting monitoring function of the firewall community while reducing operational
to visit a web page that is blocked, administrator user interface, which expenditures through streamlined
according to the corporate policy and uses log fields and regular expressions policy and reporting. Our unique
associated URL Filtering profile. To to analyze traffic, threat or configuration platform approach eliminates the
accomplish this goal, administrators events. Log filters can be saved and need for multiple, stand-alone security
can use a custom block page to exported, and for more in-depth analysis appliances and software products, and
notify end users of the policy violation, and archival, logs can also be sent to a can reduce the total cost of ownership
which can include references to the syslog server. for organizations while increasing
username, IP address, the URL they effectiveness, by simplifying their
are attempting to access, and its URL security infrastructure.
category, in addition to a customized
message from the administrator. In
order to place some of the web activity
ownership back in the user’s hands,
administrators have two options:
• URL Filtering continue: When a user
accesses a page that may pose a risk
to the organization, a customized
warning page with a “Continue” button
can be presented to the user. This
presents an opportunity to educate the
user about the risks of the requested
site and allows them to proceed if
they feel the risk is acceptable.
• URL Filtering override: Requires a
user to correctly enter a configurable
password in order to create a policy
exception and continue. This allows a
user access to a potentially critical site
with approval from the administrator.

4401 Great America Parkway © 2017 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of
Santa Clara, CA 95054 Palo Alto Networks. A list of our trademarks can be found at http://www.paloalto
Main: +1.408.753.4000 networks.com/company/trademarks.html. All other marks mentioned herein may
Sales: +1.866.320.4788 be trademarks of their respective companies. PAN_DS_URLF_121616
Support: +1.866.898.9087
www.paloaltonetworks.com