CyBlock Archives - Page 2 of 2 - Wavecrest Knowledge Base

URL List Options

The URL List Options page in Cyfin and CyBlock has two settings: List Version and Session Reporting. This article is for existing Cyfin and CyBlock customers who use Hits, Visits, and Time Online reports and want to know what the Session Reporting setting does.

Your Current Reports Stay the Same

When you upgrade Cyfin or CyBlock, Session Reporting is set to Disable. Your Hits, Visits, and Time Online reports keep working exactly as they do today, including any scheduled reports your HR team and managers receive.

You don’t need to change anything. There’s no deadline to switch, and these reports remain fully supported. If they’re working well for your organization, you can keep using them.

What Is Session Reporting?

A session is a period of continuous activity by one user on one website or application, from when the activity starts until it stops. Instead of counting individual log records, session reports show how often someone used a site and how long each session lasted.

Sessions are built for how the web works today. Websites load much of their content in the background, and a lot of the traffic in firewall and proxy logs comes from software rather than people, such as operating system updates, security tools, and tracking services. Session reporting focuses on user activity and groups related domains under familiar names (for example, content from fbcdn.net appears under Facebook).

Session reports also let you drill down step by step:

Session Analysis – which sites and categories a user accessed, and how many sessions on each
Session Audit Summary – every session on a selected site, with start time, stop time, and duration
User Audit Detail – the URLs logged during a single session

Session Audit Summary showing sessions by application with session start, stop, and duration.

Audit detail showing the URLs logged during a single session.

Sessions are the direction Wavecrest reporting is heading, and new Cyfin and CyBlock installations start with session reporting. They build on the same log data and 30 years of experience behind Hits, Visits, and Time Online.

Should You Enable It?

That’s entirely up to you, and there’s no rush. If your reports go to HR or management, those readers are used to the current format, and switching to new metrics is easier with a little planning. Some things to consider:

Who receives your scheduled reports, and when would be a good time to introduce something new
Whether you’d like to review session reports yourself before sharing them
Whether you’d like help explaining the new reports to HR or management

Our Support and Sales teams can walk you through session reporting and help you plan a smooth transition at your own pace.

Before You Enable

Enabling session reporting is meant to be a one-time move to the new reports, so make sure your organization is ready before you switch. We recommend contacting Wavecrest Support or Sales first. We’ll answer your questions, show you what the session reports will look like, and help you plan the change with the people who rely on your current reports.

Session reporting requires List 10. If your List Version is set to List 9, contact Support before making any changes.

How to Enable Session Reporting

Open the URL List Options page in Cyfin or CyBlock. [Confirm menu path, e.g., Settings > URL List Options]
Under Session Reporting, select Enable.
Click Update.

Questions?

If you’d like to learn more about session reporting or see it with your own data, contact Wavecrest Support or reach out to Sales. We’re happy to help.

Cyfin / CyBlock — E-Mail Settings FAQ

Configuring and Testing Your E-Mail Settings

Why Isn’t My E-Mail Test Working?

When setting up e-mail in Cyfin or CyBlock, the E-Mail Settings page has both a Test button and a Submit button. It may seem natural to click Test first to verify your settings — but the Test button will not work until your settings have been saved first.

You must click Submit before clicking Test.

The Correct Order

Step 1 — Fill in your e-mail settings

Enter your e-mail configuration on the E-Mail Settings page:

Administrator’s Address — the address Cyfin will send reports and alerts to
Server Name — your outgoing mail server (SMTP) hostname
Server Port — typically 25, 465, or 587 depending on your mail server
Use SSL — check this if your mail server requires an encrypted connection
Does Server Require Authentication — select Yes and enter credentials if your SMTP server requires a login
Use Server Alias in E-Mail — optionally display a friendly sender name (e.g., “Cyfin”) in outgoing messages

Step 2 — Click Submit

Click the Submit button at the bottom of the page to save your settings. You must do this first, even if you intend to test right away.

Step 3 — Click Test

Once your settings are saved, click the Test button to send a test e-mail to the Administrator’s Address. Check that inbox to confirm the message was received.

If the test e-mail does not arrive, review your settings and click Submit again before re-testing.

Quick Reference

Button	What It Does	When to Use It
Submit	Saves your e-mail settings	Always first — before testing
Test	Sends a test e-mail using the saved settings	After Submit has been clicked

Common Mistake

Clicking Test without clicking Submit first will either produce an error or test against the previously saved settings — not the values currently shown on screen. Always save with Submit before running a test.

For additional assistance, contact Wavecrest Technical Support.

CyBlock — Users Not Being Identified (Missing User IDs / Browser Login Prompt)

Applies to: CyBlock · When activity isn’t logged by username, or employees get browser login prompts.

CyBlock identifies users automatically via NTLM as their traffic passes through the proxy. When that identification fails, you’ll see one or both of these symptoms:

Usernames are blank or show as IP addresses in CyBlock activity and reports.
Employees get a pop-up username/password prompt in Edge or Chrome when browsing — even to everyday sites.

Both symptoms mean CyBlock isn’t successfully identifying the user. Work through the two areas below in order: first confirm CyBlock’s own authentication rule, then (if users are being prompted) the Windows/browser configuration.

(If usernames are appearing but all fall under Ungrouped IDs, that’s a different issue — IDs are captured but not organized into your Groups and IDs tree. See the Terms Glossary for Ungrouped IDs.)

Step 1 — Check the CyBlock Authentication Manager rule

Start here. CyBlock needs an NTLM authentication rule to identify users.

Go to User Management → Authentication → Authentication Manager.
Open the Rules tab.
Confirm there is a rule with:
- Type: NTLM, and
- Network definition: *Default

If that NTLM rule is present and correct, CyBlock is set up to identify users, and the problem is most likely on the Windows/browser side — continue to Step 2. If the rule is missing or its network definition is wrong, correcting it here is the fix.

Step 2 — If employees are being prompted to log in (Windows/browser configuration)

What’s happening and why

CyBlock identifies users silently by asking the browser to confirm the employee’s Windows login as traffic passes through the proxy — normally invisible to the user. Recent Windows 11 and Edge/Chrome security changes tightened the rules around this automatic sign-in, so the browser now needs to be explicitly told it’s safe to release Windows credentials to the CyBlock proxy. If it isn’t, the browser either prompts the employee for credentials or skips identification entirely (leaving usernames blank).

This is a Microsoft security change, not a CyBlock defect. The fix is applied by your IT administrator via Group Policy (GPO), which pushes the settings to all computers at once. Getting cloud-proxy NTLM working reliably requires two GPO controls — both must be in place.

Which browsers need configuration

Microsoft Edge — requires configuration
Google Chrome — requires configuration
Internet Explorer — not affected
Firefox — uses a separate process; contact Wavecrest Support if Firefox is in use

Layer 1 — Allow the proxy to request Windows authentication (AuthServerAllowlist)

This tells Edge and Chrome that the CyBlock proxy is allowed to request integrated Windows authentication.

Microsoft Edge (GPO):

Open Group Policy Management Console (gpmc.msc) and edit a GPO linked to the OU containing your computers.
Go to Computer Configuration → Administrative Templates → Microsoft Edge → HTTP authentication.
Open Configure list of allowed authentication servers, set it to Enabled.
In the value field, enter: *.cloud.cyblock.com,cloud.cyblock.com
Click OK.

(First-time setup: download the Edge policy templates from https://www.microsoft.com/en-us/edge/business/download and copy msedge.admx / msedge.adml into your domain controller’s Central Store.)

Google Chrome (GPO):

In the same or a linked GPO, go to Computer Configuration → Administrative Templates → Google → Google Chrome → HTTP authentication.
Open Authentication server allowlist, set it to Enabled.
In the value field, enter: *.cloud.cyblock.com,cloud.cyblock.com
Click OK.

(Registry equivalent, for non-domain machines — apply as a computer/HKLM policy:

Edge: HKLM\SOFTWARE\Policies\Microsoft\Edge → AuthServerAllowlist (REG_SZ) = *.cloud.cyblock.com,cloud.cyblock.com
Chrome: HKLM\SOFTWARE\Policies\Google\Chrome → AuthServerAllowlist (REG_SZ) = *.cloud.cyblock.com,cloud.cyblock.com)

Layer 2 — Move the proxy into the Local Intranet zone (Site to Zone Assignment)

Even with Layer 1 set, Windows checks the security zone of the proxy host before it will release credentials automatically. Because cloud.cyblock.com is an internet-hosted address, Windows treats it as the Internet zone, and Internet-zone hosts prompt the user instead of signing in silently. The proxy must be reassigned to the Local Intranet zone for automatic authentication to work.

GPO:

Go to Computer Configuration → Policies → Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Site to Zone Assignment List.
Set it to Enabled, then click Show and add:
- Value name: cloud.cyblock.com
- Value: 1 (1 = Local Intranet zone)
Click OK.

(Even though the GPO path says “Internet Explorer,” this zone list is also read by Edge and Chrome for the integrated Windows authentication credential decision.)

(On-premise / appliance deployments: substitute your own internal proxy hostname for cloud.cyblock.com. Whether the zone step is needed depends on whether your proxy hostname already resolves to the Local Intranet zone — contact Wavecrest Support if unsure.)

Single-machine test (before a full GPO rollout)

To confirm the two-layer fix on one affected machine before deploying via GPO, run these as Administrator, then fully restart the browser and check the CyBlock log for usernames:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\cloud.cyblock.com" /v https /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v AuthServerAllowlist /t REG_SZ /d "*.cloud.cyblock.com,cloud.cyblock.com" /f

Apply and verify

Run gpupdate /force on a test machine (or wait for Group Policy to refresh).
Fully restart the browser — these policies require a complete browser restart, not just a new tab.
Confirm the policy is active: open edge://policy (Edge) or chrome://policy (Chrome) and check that AuthServerAllowlist shows the correct value.
Browse to any external site, then check the CyBlock activity log for the username.
If it’s still not working, check Event Viewer → Applications and Services Logs → Microsoft → Windows → GroupPolicy for GPO application errors.

Troubleshooting

Symptom	Likely cause	Action
Usernames blank, no NTLM rule found	CyBlock auth rule missing	Add/correct the NTLM rule (`*Default`) in Authentication Manager (Step 1)
Login prompts persist after GPO deployed	Browser not fully restarted	Close and reopen all browser windows
Usernames still blank after Layer 1	Proxy still in Internet zone	Apply the Layer 2 Site-to-Zone assignment
Policy not showing in `edge://policy`	Edge ADMX templates not installed	Install templates in the Central Store on your domain controller
Only some computers affected	GPO linked to wrong OU	Ensure the GPO is linked to the OU with computer accounts, not user accounts

Additional notes

Apply these as computer policies (HKEY_LOCAL_MACHINE), not user policies.
Multiple proxy addresses can be listed, comma-separated, no spaces.
This is part of Microsoft’s ongoing phase-out of older authentication methods; Wavecrest will update guidance as the rollout continues.
For help, contact support@wavecrest.net.

Does CyBlock Support Remote Desktop Environments?

Yes, CyBlock fully supports remote desktop environments. As long as users log in with their individual accounts, CyBlock will function seamlessly whether the user is physically sitting at their computer or remotely connected to it. This ensures that all features and monitoring capabilities are consistent and effective, regardless of the user’s location.