Triage a DNS-layer filtering event (Cisco Umbrella, DNSFilter, or equivalent). The
discrimination is everything: a security-category block is a detection — something on the
endpoint tried to go there — while a content-category block is a policy event. Bypasses,
allowlist entries and recategorization requests are technician actions you direct and record.
1. Classify the event: security block (malware, command-and-control, phishing, cryptomining,
newly-seen or DGA domains), content block (social media, streaming, gambling — the client's
policy), or uncategorized domain.
2. Security-block path — treat it as a detection. Blocked is not done:
- Identify the source: which device or user made the lookup. With only the site's egress IP,
the technician identifies the internal source from the filter's console or DHCP/firewall
logs; say so when attribution is unavailable.
- A one-off lookup to a phishing domain is usually a clicked link: run phishing-triage on how
the user got the URL and check for sibling deliveries.
- Repeated or periodic lookups to C2 or malware domains are a beaconing pattern: treat the
endpoint as suspect and work edr-detection-runbook on it. Do not close because "it was
blocked" — the block contains the symptom, not the infection.
- Check prior tickets (same device or domain class, ~90 days) for recurrence.
3. Category-block complaints: confirm the block reason against the client's documented filtering
policy. Miscategorized → raise a recategorization request with the vendor, plus a narrow
temporary allow if the need is business-urgent. Correctly categorized but business-needed →
this is the client's policy decision, not a desk favor: route it to the authorized approver
on file. The desk does not loosen a client's policy on a user's say-so.
4. Bypass discipline: narrowest scope (exact domain over wildcard, one user or site over
global), time-boxed where the need is temporary, named client approver, review date — an
allowlist that only grows is a policy that no longer exists. Never bypass a security
category; if someone insists a malware-class block is wrong, escalate the domain for vendor
recategorization with evidence instead. Verify identity before any user-specific bypass — a
"please unblock this for me" from a compromised mailbox is a real pattern.
5. Recurring vendor false positives (CDNs, ad networks tripping security categories) go to
security-noise-tuning under the same narrow-allow discipline.
6. Note the event class, source attribution, verdict, and any allow's scope, approver and
expiry; classify security-class events per soc-classification-tree.
If the console isn't accessible, name what the tech should pull — query logs, source identity,
category verdict. When in doubt do nothing irreversible and escalate.
Magic Library