Web Filtering configuration (Mobile Threat Defense policy for Android)
With the Web Filtering configuration you manage the Web Filtering feature of Sophos Intercept X for Mobile. This protects users from browsing sites with malicious, undesirable or illegal content.
Web Filtering uses the Sophos website classification service
https://4.sophosxl.net/lookup. If Web Filtering can’t connect to this service, it blocks all websites.
Web Filtering doesn’t work with Android Enterprise work profile devices. This is because Web Filtering requires the Sophos Accessibility Service, which is not available when Sophos Intercept X for Mobile is installed in the work profile.
When you turn on Web Filtering, Sophos Mobile always blocks web pages categorized as highly objectionable criminal activity, such as child pornography. To prevent others from accessing these pages, Sophos Mobile masks the URLs in logs, events, and reports.
We recommend that you set the Intercept X for Mobile permissions can be denied compliance rule to No when using Web Filtering. With this setting, the device becomes non-compliant when Web Filtering stops working because the user turned off the Sophos Accessibility Service.
|Filter malicious websites||Select whether users can access websites with malicious content.|
|Create events||When the user tries to open a filtered website, Sophos Mobile creates an event, which you can see on the device’s details page. |
You can select whether Sophos Mobile creates events only when a site is blocked or also for sites that produce a warning.
|Filter websites by category||Select whether users can access types of websites. |
Websites are categorized based on data from SophosLabs. The data is updated constantly.
|Website exceptions||Configure exceptions to the category filters: |
In Allowed domains and Blocked domains, enter one of the following per line (without separator):
IPv4 or IPv6 address
IPv4 or IPv6 subnet
Wildcard domain. The wildcard
*must be the leftmost character.
In Blocked domains, you can use a single wildcard
* to block all websites.
When Web Filtering evaluates whether a website must be allowed or blocked, the allow list takes precedence over the block list, and policy-defined lists take precedence over user-defined lists.
Filtering rules are applied in the following sequence:
- If the website is included in Allowed domains, it is allowed.
- If the website is included in Blocked domains, it is blocked.
- If the user has added the website to the allow list, it is allowed.
- If the user has added the website to the block list, it is blocked.
- If the website belongs to a category that’s forbidden, it’s blocked.
Web Filtering can be used in combination with the following web browsers:
- Android web browser
- Google Chrome
- Microsoft Edge
Other browsers may also work, but have not been tested.
Testing Web Filtering
For the purpose of testing website filtering, Sophos has created the site sophostest.com containing example pages for each category. Although some of these pages are classified as potentially offensive or dangerous, the page content itself is harmless in all cases.