How do I create exceptions and how do they work?

Forcepoint Web Security and Forcepoint URL Filtering | v8.5.x | 29-Apr-2022

Exceptions override policies to permit or block access to specific URLs for specific clients. Use an exception to:

Permit access for all employees to a specific URL that would otherwise be blocked based on its category.

Block all clients in a specific role from a suspicious uncategorized URL while the site is investigated.

Permit temporary access to a URL for certain members of a group while continuing to block the site for the rest of the group.

Permit access to URLs only when accessed from specific sites (referers). See "What is a Referer?" in the Administrator Help for additional information.

Exceptions allow a flexible and rapid response to user requests, changes in company policies, spikes in Internet activity, or other changes in circumstance.

Use the Policy Management > Exceptions page to add, review, edit, or delete exceptions. The page shows the following information for each exception:

The Name given to the exception when it was created.

The URL or regular expression permitted or blocked by the exception, or a link to the complete list of URLs or expressions (if the exception includes more than one).

If the exception is defined with referer information and no URLs or regular expressions were specified in the exception, text in this column explains that access to all URLs is permitted if accessed from a referer site.

The URL of the approved Referer or a link to a complete list of referer URLs assigned to the exception (if one or more approved referers is included in the exception).

The name of the Client, if the exception applies to one client, or the role name (if the exception applies to an entire delegated administration role), Global (if all clients are affected), or a link to a complete list of affected clients.

The exception Type, an icon indicating whether URLs in the exception are blocked, permitted, or permitted with security override disabled.

Additional hover over text is provided ("Permitted by referer" or "Permitted by referer, even when security risks are found") when approved referers are included in the exception.

When the exception Expires, either an expiration date, or Never.

Whether the exception is Active (used to block or permit requests) or Inactive (either expired, or just not currently in use).

The date the exception was Last Modified.

Click Add below the list to create an exception.

Click the link that is the name of the exception or mark the check box next to an exception and click Edit to edit an existing exception.

See the Administrator Help for instructions for creating exceptions.

If multiple exceptions could apply to a request, how is the right one selected?

To apply exceptions, Filtering Service uses the following rules:

By default, Super Administrator exceptions take precedence over exceptions created by delegated administrators.

A delegated administrator exception takes precedence when the Super Administrator exception has been defined to allow delegated administrator override.