RSA Admin

Cisco Ironport WSA

Discussion created by RSA Admin Employee on May 7, 2010

Hi Just wondering if anyone out there is doing anything interesting with monitoring users web access.

I have created one alert for large downloads.  This alerts on any downloads greater that 200MB.


I am more interested in what users are uploading via web email, but I have been unsuccessful in creating such an alert. ftp and other uploads included.


We are also alerting on users that access blocked url categories.  I have found these to create a number of false positives when users open web based emails as they attempt to download any content within the body of the email.


Any other suggestions in what monitor would be great.  Thanks in advance.