Trigger: Blocked Web Incident Alert from Browser Protection System (e.g., DNS Filtering, Secure Web Gateway, Browser Extension, EDR)
Input: Incident Data (includes: blocked URL, user ID, device, threat category, timestamp, and policy violated)
Condition: Analyze the threat_category or detection_type field.
Branches:
Malicious (Phishing, Malware, C2): Proceed to Step 2 (Prioritized Investigation)
Policy Violation (e.g. Gambling, Adult Content, Unauthorized Tools): Proceed to Step 3 (Standard Investigation)
Informational (e.g. Ads, Tracking, Low Risk): End flow – log only, no further action.
Collect ContextIdentify the user and device involved
Gather incident details: timestamp, URL, category, action taken
Notify Security AnalystAlert security/IT admin via Slack/email with:
Summary of the event
User identity and device name
Link to full incident log (if available in vendor portal)
Recommended Actions (manual or automated):Inform the user about the blocked attempt and remind them of safe browsing habits
Schedule follow-up awareness training
Check if similar blocks occurred from other users (pattern detection)
Escalate to SOC for deeper investigation if repeated
Log and ReviewLog event with user, device, timestamp, and blocked category
Check if this is a first-time or repeat offense
User Notification1st time: Notify user with a friendly reminder of company browsing policy
2nd time: Notify manager and request user acknowledgment of Acceptable Use Policy
3rd time: Escalate to security team for review
OutputMalicious Attempts: Analyst notification + user flagged
Policy Violations: Logged + user/manager notified if repeated
Informational: Logged only
Key ConsiderationsError Handling: If user/device details are missing, log the event and flag it for manual review
Security: Use secure channels for notifications
Customization: Adapt categories and thresholds to match your internal acceptable use and security policy
Let me know if you want this converted into a checklist, playbook document, or integrated with a specific system like Jira, Slack, or a SOAR tool.
4o
add also to take into account the number of violation by a user and if specific thresholds are met, provide additional training
Perfect — here is the updated, simplified Browser Protection Incident Investigation Flow, now including logic to track the number of violations per user and trigger additional training once thresholds are met:
Flow Name: Automated Browser Protection Incident Investigation
Trigger: Blocked Web Incident Alert from Browser Protection System (DNS Filtering, Browser Extension, EDR)
Input: Incident Data (includes: blocked URL, user ID, device, threat category, timestamp, and policy violated)
Condition: Review threat_category or detection_type field.
Branches:
Malicious (Phishing, Malware, C2, etc): → Step 2: Malicious Site Investigation
Policy Violation (Gambling, Adult, Hacking Tools, etc): → Step 3: Policy Violation Investigation
Informational (Ads, Tracking, Uncategorized): → End flow – Log only, no action.
Collect ContextRetrieve user ID, device name, URL, timestamp, category, number of previous incidents (last 90 days)
Notify Security AnalystAlert via Slack/email with:
Summary of the blocked attempt
User & device details
Link to full logs (from the browser protection platform)
Recommended Actions:1st or 2nd incident: Notify the user and send secure browsing guidance
3rd+ incident in 90 days:
Automatically enroll user in phishing or secure browsing training
Escalate to manager or IT for review
Consider follow-up discussion or temporary restrictions if pattern continues
Logging & Violation CounterLog event with user, timestamp, URL category
Check number of policy violations in the last 90 days
Actions by Violation Count:1st Violation:
Notify user with friendly Acceptable Use Policy reminder
2nd Violation:
Notify manager and request user acknowledgment of policy
3rd Violation:
Enroll user in Acceptable Web Use Training
Flag user for IT/Security team review
4th+ Violation:
Escalate for potential disciplinary or technical restrictions (per internal policy)
Output/RecommendationsViolation Type | User Notified | Manager Notified | Training Assigned | Security Notified |
Malicious – 1st/2nd |
|
|
|
|
Malicious – 3rd+ |
|
|
|
|
Policy – 1st |
|
|
|
|
Policy – 2nd |
|
|
|
|
Policy – 3rd+ |
|
|
|
|
Key ConsiderationsTracking: Maintain a rolling 90-day window of incidents per user to enforce thresholds
Automation: Can be implemented in SOAR, SIEM, or webhook-based integrations
Scalability: Thresholds and escalation actions can be tuned per department or risk profile
Error Handling: If user or device data is incomplete, log for manual analyst review
Security: Ensure notifications (especially escalations) follow secure internal comms practices