Cisco Cognitive Intelligence relies on web access log data from each Cisco Secure Web Appliance. When multiple appliances are deployed, the required log subscription must be configured on each appliance so all relevant traffic data is sent for analysis.

The access log shows the request was allowed because of a referrer-based embedded-content exception. This means the social networking content was permitted when loaded as embedded content from an allowed referring page, even though the social networking category is normally blocked by the policy.

URL Filtering compares requested websites against Cisco security intelligence and predefined categories. Administrators can allow, block, or monitor access based on security policies, helping prevent users from visiting phishing, malware-hosting, or inappropriate websites.

Explanation:
To configure an access policy using URL categories, you first navigate to the relevant policy area in Web Security Manager, select the specific policy to edit, open the URL Categories configuration from the advanced policy settings, and then choose the URL categories that will be used to match and control web requests.

Cisco Secure Web Appliance access logs record transaction time using UNIX timestamp format.
To search for entries from a specific date and time with grep, the engineer must convert that date and time into its UNIX timestamp value and use it in the regular expression.