Issue:
An information event "Connection control has blocked the network connection. The blocked application: chrome.exe / firefox.exe / edge.exe" was logged for Elements Endpoint Protection (EPP for Computers or EPP for Servers) on the Security Events page in the Elements Endpoint Protection portal
What does this block event mean? Why is no website address (URL) being listed?
Resolution:
Connection Control is also known as "Banking Protection". It is the feature which activates when a user enters a banking site. When Connection Control is active, the browser only allows the user to visit trusted websites.
If a full page is blocked, the user will receive a splash page which alerts the user that a page has been blocked, and if they need to access the page while Connection Control is active, they can allow the website. Sometimes simple analytics addresses are being blocked, which do not affect the user at all, which is why it can get unnoticed by the user and still an alert is sent to the Security Events page.
With the default settings, due to regional legislation differences, the page address is only shown fully to the local user while in the Elements Endpoint Protection portal's Security Events page only the affected browser or process is listed.
You can from the profiles change the following setting if you want the Security Events page to show the website URL:
- Log in to the Elements Endpoint Protection portal
- Go to the Profiles page
- Select the profile which is in use on the device
- Go to the Browsing Protection settings page
- Enable Include the blocked URLs in all security events (bottom of the page)
- Click Save and publish
Note that you need to be sure that your regional legislation allows you to monitor users in such a way.
Article no: 000038313