Let each customer filter the web by what a site is.
Your secure web gateway (SWG) already sits between users and the web. The question is what kind of site a request goes to, and how risky it is, before the request goes through. License our category and threat data, keep a local copy, and look up the rest.
Secure web gateway threat intelligence is content categories for domains, URLs and millions of IPs, plus risk scores for domains, URLs and IPs, that web gateways check against each request. alphaMountain licenses it as URL Classification (92 content categories), Threat Feed (a 1.0 to 10.0 risk score) and Domain/IP reputation factors. Available as OEM, white label or co-branded. See how OEM licensing works.
Give each customer three kinds of control.
- Web filtering: sort sites into 92 content categories, so customers can block risky content, enforce company policy and limit exposure to risky sites.
- Threat and malware protection: a risk score for domains, URLs and IPs helps your gateway block malware, phishing and scam sites.
- Data loss prevention (DLP): blocking access to high-risk destinations helps limit data leaving a customer's network. Block or allow whole kinds of destination by category, such as file sharing and storage or generative apps.
A score of 1.0 is very safe and 10.0 is known malicious. Scores from 7.0 to 8.49 are suspicious, so warn or block based on each customer's risk appetite. Scores of 8.5 and up are malicious, and we recommend blocking them.
Let your customers tune their own policy.
A category says what kind of site it is, and a risk score says how dangerous it is, so your rules can use both. With Category Feed, you receive only the categories you choose. With Threat Feed, you receive new findings in the score range you choose, 7.0 and up by default.
Cover new sites with the Query API.
A user can ask for a site nobody has seen before, such as a newly registered domain. Your gateway checks your local database (DB) copy first. Anything missing goes to the Query API, which returns what your subscription covers, a category or a risk score. For a URL with no stored rating, a rapid lookup runs and the URL is queued for deeper analysis.
Keep the data next to your gateway.
Run your local DB copy as a database that your gateway queries. The Batch API sends batch updates to your local DB copy every hour, delivered as Category Batch or Threat Batch. Everyday lookups stay off our cloud infrastructure, so stability, response time and caching are yours to control.
Count requests, not users.
Each user opens many sites a day, so lookups add up. Count the requests your gateway checks, not the number of users.
- Up to about 100,000 lookups a day: the Query API alone fits.
- Above that: we recommend batch. The Query API handles up to 300,000 a day, but your local DB copy keeps response time under your control.
License it the way you sell your gateway.
License the data on a royalty or consumption basis. Take the category or threat database alone, or both as a bundle.
Try it on your own traffic first.
Free trials are available, and we support your proof of value. To check a site now, look it up in threatYeti. We score domains, URLs and IPs, not files.
FAQ
Can our email gateway use the same data?
Yes. An email gateway checks the links and senders in messages. A web gateway checks the sites users ask for. The same data serves both. See secure email gateways.
Does this help with data loss prevention?
It helps limit data leaving a network, by blocking high-risk destinations and by blocking or allowing categories such as file sharing and storage. We score domains, URLs and IPs. We don't inspect files or the content of traffic.
How current is our data?
The database updates every hour. Batch updates reach your local DB copy every hour, and Query API lookups see each update too. For a site your copy hasn't seen, use the Query API.
Bring your gateway traffic.
Tell us how many users your gateway serves and how many requests they make a day. We'll match the products, delivery and licensing to it.