CG3 - Browser Defender: Browsing Alerts

The Browsing Alerts page collects in a single view all visits to sites flagged as dangerous by the Browser Defender extension. Reports come from two independent sources: artificial intelligence-based analysis (Live Detection) and company policy or external threat intelligence lists (Knowledge Base). From here, administrators review the history, apply remediation by domain, and export the log. To access it, open Browser Defender from the side menu and select Browsing Alerts. It requires Browser Defender active for your company, the Platform Administrator role, and the extension deployed to monitored users: without it, no browsing activity is observed and no alerts can be generated.

This page lets you:

• Get a company-wide overview of domains visited despite a warning, from both detection sources.
• Analyze a domain's history — URLs involved, users, and the action each took — before deciding whether to intervene.
• Apply remediation by domain: block browsing, allow it, or on the Live Detection tab, silence further AI alerts for that domain.
• Review archived alerts and export the log as CSV.

This page is not designed for: deciding what counts as dangerous (the responsibility of Live Detection and Knowledge Base), configuring shared policy in bulk for domain/URL (Advanced options), managing password reuse or dangerous download alerts (Password Reuse, Dangerous Downloads), or deploying the extension (Setup, Users).

The page opens on the Live Detection tab. All three views share the same domain table — Domain, Alerts, Users, and the Remediation icon — sorted by most recent alert:

• Live Detection — alerts from artificial intelligence-based analysis.
• Knowledge Base — alerts from company policy or external threat intelligence sources.
• Archived Alerts — archived alerts from both sources.

Search filters the table by domain name; Filter narrows it by remediation status. Available options vary by tab:

Clicking a domain opens the detail panel: the latest event and, per row, URL, User action (Visited: proceeded despite the warning; Cancelled: did not proceed; Domain trusted, Live Detection only: the user's choice from their browser), and Remediation. On the Knowledge Base tab, each URL also shows whether the alert comes from Company policy or an external source (External sources).

NOTE: some alerts with Company policy origin remain permanently blocked, with no option to dismiss the warning, regardless of the blocking mode configured for your company. These alerts are not visually distinct in the list: you recognize them by behavior, because the Trust action does not remove the block.

From the panel (not available on Archived Alerts), you apply remediation; Trust/Untrust and Block change meaning depending on the tab:

Advanced options opens the shared policy panel for domain/URL (password reuse, browsing, phishing, and downloads together).

NOTE: a domain marked as trusted on one tab may still be flagged on the other.

Export, on each tab, downloads the log as CSV (comma-separated values) with columns Domain, URL, User email, User action, Source, Trigger reason (brief risk category detected), and Date; it reflects any Search/Filter applied. Archive moves a domain's alerts to Archived Alerts; Unarchive returns them to their original tab (Live Detection or Knowledge Base). Search, filter, tab change, and remediation update the table and panel immediately.

Some elements that affect what appears on this page are configured elsewhere:

• Domains and URLs always allowed or always blocked by company policy — managed from Setup > Safelist/Blocklist.
• AI detection at company level — can be enabled in Setup > Preferences > Advanced Settings.
• Blocking mode at company level — configurable in Setup > Preferences, section Company level settings, option Browsing Protection.
• Extension deployment — managed from Setup > Setup Checklist.