What is WebCatcher?

WebCatcher is an optional feature that collects unrecognized and security-related URLs, and submits them to Security Labs. Uncategorized URLs are reviewed for categorization, and security-related URLs are analyzed for what they can reveal about active Internet threats. (Full URL logging is not required for WebCatcher processing.) The results of the analysis are used to update the Forcepoint URL Database, resulting in improved performance.

Note: If you have multiple Log Server instances, enable WebCatcher only once, on the Web > Settings > General > Accounts page in the Forcepoint Security Manager.

The information sent to Security Labs contains only URLs and does not include user information. For example:

<URL HREF="http://www.ack.com/uncategorized/" CATEGORY="153" IP_ADDR="200.102.53.105" NUM_HITS="1" />

The IP address in the example reflects the IPv4 or IPv6 address of the machine hosting the URL, not the requester’s IP address.

Note: Intranet sites are not sent by WebCatcher. This includes all sites with IP addresses in the 10.xxx.xxx.xxx, 172.16.xxx.xxx, and 192.168.xxx.xxx ranges.

WebCatcher data is sent to Forcepoint servers via HTTP post. You may need to create roles or make other changes on your proxy server or firewall to permit the outgoing HTTP traffic.