The Live Detection tab on the Browsing Alerts page collects domains flagged by the real-time analysis that the Browser Defender extension performs on pages visited by users. It also includes ClickFix attack attempts detected on the clipboard. It is one of two detection sources on the page: the other, based on company policy and external threat intelligence lists, is Knowledge Base, documented separately. To access it, open Browser Defender from the side menu and select Browsing Alerts: the page opens on this tab by default. It requires Browser Defender active for your company, the Platform Administrator role, and the extension deployed to monitored users: without it, no pages are analyzed.
What this tab does
This tab allows you to:
- Understand why an alert appeared: real-time analysis flagged the page as suspicious, or a ClickFix attempt was detected.
- Decide how to act on a domain: mark it as trusted to silence further Live Detection alerts, or block it entirely — independently of Knowledge Base.
- Adjust, from company settings, how aggressive the two detection controls are (see below).
This tab is not designed for: searching, exporting, or viewing other tabs on the Browsing Alerts page (documented separately), configuring the shared policy for domain/URL (Advanced options), or managing password reuse or dangerous download alerts (Password Reuse, Dangerous Downloads).
The detail panel and remediation actions
Filter narrows the domain table on this tab to Live detection alerts disabled or Browsing blocked.
Clicking a domain opens the detail panel: date of the last alert, number of alerts, and users involved. Clicking a single URL shows User action — Visited (the user proceeded despite the warning), Cancelled (did not proceed), or Domain trusted (the user chose, from their browser, to mark the domain as trusted — distinct from the administrator's Trust action) — and the reason for the flag (see below).
From the panel, you apply one of these actions for the entire domain:
| Action | Effect |
| Trust / Untrust | Silences further Live Detection alerts for the domain; also cancels any active Block, without affecting the Knowledge Base status of the same domain. |
| Block / Unblock | Completely blocks navigation to the domain, with no bypass possible; cancels any alert-disabled status. |
| Advanced options | Opens the shared policy panel for domain/URL (password reuse, browsing, phishing, and downloads together). |
The reason for the flag
Each flagged URL also shows the reason for detection:
| Reason | Meaning |
| Credential harvesting | The page attempts to collect login credentials: a password field, or the user's email in a suspicious form. |
| Financial data theft | The page contains a payment card data field, or the user entered a card number on it. |
| Click-Fix | Suspicious clipboard activity, traceable to a ClickFix attack attempt. |
| Recently created domain | The domain was registered recently, a typical indicator of phishing or fraud. |
| Previous analysis | The page was already flagged by a previous Live Detection analysis. |
Multiple reasons can appear on the same alert.
NOTE: the flag reason uses the term Click-Fix; the setting that controls its detection is called ClickFix Protection (see below) — similar names, same mechanism.
The two independent detection settings
This tab is configured in Setup > Preferences > Advanced Settings, with two independent controls:
| Setting | Mode | Effect |
| AI Browsing Protection | Disabled | Page analysis is not performed. |
| AI Browsing Protection | Monitoring mode | Analysis runs in the background, with no warning to the user; details remain visible here to the administrator. |
| AI Browsing Protection | Alert mode | The user is warned and sees a full-page warning if the page is flagged; details remain visible here as well. |
| ClickFix Protection | Disabled | ClickFix attempts are not detected. |
| ClickFix Protection | Monitoring mode | Detection runs in the background, with no warning to the user; details remain visible here if an attempt is flagged. |
NOTE: the two settings are independent — disabling one does not disable the other. ClickFix Protection has no Alert mode, only Disabled or Monitoring mode: end users never see a ClickFix warning, unlike AI Browsing Protection in Alert mode.
Settings managed on other pages
Some elements that affect what is shown on this tab are configured elsewhere:
- Navigation blocking mode — the Browsing Protection mode (Setup > Preferences, Company level settings section) governs navigation blocking for all alerts, including those on this tab.
Troubleshooting
| Symptom | Likely cause | Solution | Escalation |
| ClickFix alerts keep appearing after disabling AI Browsing Protection | ClickFix Protection is separate from AI Browsing Protection | Disable ClickFix Protection separately in Setup | Contact support if the issue persists. |
| End users never see a ClickFix warning, even with protection active | ClickFix Protection currently has no Alert mode, only Disabled or Monitoring mode | Expected behavior: the administrator still sees flagged domains here | — |
| The flag reason shows "Previous analysis" with no other details | The page was already flagged by a previous Live Detection analysis | Check Advanced options or the domain's alert history | — |