Category reason code
If you are using an SIEM integration to send log data to a third-party SIEM product, use the following table to map the ID shown in the categoryReasonCode field to the reason the URL was placed in the category indicated in the categoryNumber field.
| ID | Description |
|---|---|
| 0 | None |
| 1 | Found in the Forcepoint URL Database |
| 2 | Regular expression matched in the URL Database |
| 3 | Found in a Real-Time Database Update or Real-Time Security Update database |
| 4 | Regular expression matched in a Real-Time Database Update or Real-Time Security Update database |
| 5 | Custom URL - permit |
| 6 | Custom URL - deny |
| 7 | Private IP address |
| 8 | Categorized by keyword |
| 9 | Categorized by Content Gateway analysis |
| 10 | Multi-term search |
| 11 | Categorized by the hybrid service (requires the Web Hybrid module) |