FAQ
Cyfin / CyBlock — E-Mail Settings FAQ
Configuring and Testing Your E-Mail Settings
Why Isn’t My E-Mail Test Working?
When setting up e-mail in Cyfin or CyBlock, the E-Mail Settings page has both a Test button and a Submit button. It may seem natural to click Test first to verify your settings — but the Test button will not work until your settings have been saved first.
You must click Submit before clicking Test.
The Correct Order
Step 1 — Fill in your e-mail settings
Enter your e-mail configuration on the E-Mail Settings page:
- Administrator’s Address — the address Cyfin will send reports and alerts to
- Server Name — your outgoing mail server (SMTP) hostname
- Server Port — typically 25, 465, or 587 depending on your mail server
- Use SSL — check this if your mail server requires an encrypted connection
- Does Server Require Authentication — select Yes and enter credentials if your SMTP server requires a login
- Use Server Alias in E-Mail — optionally display a friendly sender name (e.g., “Cyfin”) in outgoing messages
Step 2 — Click Submit
Click the Submit button at the bottom of the page to save your settings. You must do this first, even if you intend to test right away.
Step 3 — Click Test
Once your settings are saved, click the Test button to send a test e-mail to the Administrator’s Address. Check that inbox to confirm the message was received.
If the test e-mail does not arrive, review your settings and click Submit again before re-testing.
Quick Reference
| Button | What It Does | When to Use It |
|---|---|---|
| Submit | Saves your e-mail settings | Always first — before testing |
| Test | Sends a test e-mail using the saved settings | After Submit has been clicked |
Common Mistake
Clicking Test without clicking Submit first will either produce an error or test against the previously saved settings — not the values currently shown on screen. Always save with Submit before running a test.
For additional assistance, contact Wavecrest Technical Support.
CyBlock Web Filter — Browser Login Prompt FAQ
Why Are My Employees Being Asked to Log In When Browsing the Web?
Overview
After a recent Windows or browser update, employees at some organizations have started seeing unexpected username and password login prompts pop up in their browser when trying to visit websites. In some cases, websites may load but user activity is no longer being logged by name in CyBlock — showing up as blank or as an IP address instead.
This is not a CyBlock outage or a problem with the websites themselves. It is caused by a recent Microsoft security change that affects how browsers handle the automatic sign-in process that CyBlock relies on to identify users. This FAQ explains the issue and walks your IT administrator through the fix.
Frequently Asked Questions
What are employees experiencing?
Employees may see one or both of the following:
- A pop-up login prompt in Microsoft Edge or Google Chrome asking for a username and password when browsing to websites — even sites they visit every day.
- No visible prompt, but CyBlock activity reports show usernames as blank or as an IP address, meaning user identification has silently stopped working.
Both symptoms have the same root cause and the same fix.
What is causing this?
CyBlock identifies users automatically and silently by asking the browser to confirm the employee’s Windows login credentials as web traffic passes through the CyBlock proxy. This happens in the background — employees normally never see it or have to do anything.
Recent updates to Windows 11 and the Microsoft Edge and Google Chrome browsers have tightened the rules around this automatic sign-in process. Browsers now require that the proxy server be on an approved list before they will share credentials with it. If CyBlock’s proxy address is not on that list, the browser will either:
- Pop up a manual login prompt asking the employee to enter credentials themselves, or
- Skip the process entirely, leaving CyBlock unable to identify who is browsing.
This is a Microsoft security change, not a CyBlock defect.
Is this affecting everyone?
Not necessarily all at once. The change is rolling out gradually with Windows and browser updates, so you may see it affect some computers before others. Organizations running Windows 11 version 24H2 or later, or those with recently auto-updated versions of Edge or Chrome, are most likely to see this now.
How is this fixed?
Your IT administrator needs to add the CyBlock proxy address to an approved list that tells Edge and Chrome it is safe to automatically sign in through it. This is done using a Group Policy (GPO), which pushes the setting to all company computers at once — no changes needed on individual desktops.
Once deployed, the login prompts will stop and CyBlock will resume capturing usernames automatically.
Which browsers need to be configured?
- Microsoft Edge — requires configuration
- Google Chrome — requires configuration
- Internet Explorer — not affected
- Firefox — uses a separate process; contact Wavecrest Support if Firefox is in use
Will this fix affect anything else on our computers?
No. This setting only tells Edge and Chrome to allow the automatic sign-in process specifically for the CyBlock proxy address. It does not change how any other websites or services authenticate, and it does not lower security elsewhere.
Fix: Step-by-Step Configuration Instructions
These steps are for your IT Administrator. They require access to Group Policy Management on your Windows domain.
Microsoft Edge — via Group Policy (Recommended)
First-time setup: Download the Microsoft Edge policy templates from: https://www.microsoft.com/en-us/edge/business/download
Copy these files to your domain controller’s Central Store:
windows\admx\msedge.admx→C:\Windows\PolicyDefinitions\windows\admx\en-US\msedge.adml→C:\Windows\PolicyDefinitions\en-US\
Steps:
- Open Group Policy Management Console (
gpmc.msc). - Create or edit a GPO linked to the OU containing your computers.
- Navigate to:
Computer Configuration → Administrative Templates → Microsoft Edge → HTTP authentication - Open the policy: Configure list of allowed authentication servers
- Set it to Enabled.
- In the value field, enter:
*.cloud.cyblock.com,cloud.cyblock.com - Click OK and close the editor.
- Run
gpupdate /forceon a test machine or wait for Group Policy to refresh. - Restart the browser — this policy requires a full browser restart to take effect.
Microsoft Edge — via Windows Registry Manual
Use this method for non-domain environments or to deploy via a login script.
Registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge
Value:
- Name:
AuthServerAllowlist - Type:
REG_SZ(String) - Data:
*.cloud.cyblock.com,cloud.cyblock.com
Google Chrome — via Group Policy (Recommended)
First-time setup: Download the Chrome ADMX templates from Google’s admin page and add them to your domain’s Central Store.
Steps:
- Open Group Policy Management Console (
gpmc.msc). - Create or edit a GPO linked to the OU containing your computers.
- Navigate to:
Computer Configuration → Administrative Templates → Google → Google Chrome → HTTP authentication - Open the policy: Authentication server allowlist
- Set it to Enabled.
- In the value field, enter:
*.cloud.cyblock.com,cloud.cyblock.com - Click OK and close the editor.
- Run
gpupdate /forceon a test machine or wait for Group Policy to refresh. - Restart the browser to apply the change.
Google Chrome — via Windows Registry Manual
Registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
Value:
- Name:
AuthServerAllowlist - Type:
REG_SZ(String) - Data:
*.cloud.cyblock.com,cloud.cyblock.com
Troubleshooting
| Symptom | Likely Cause | Action |
|---|---|---|
| Login prompts persist after GPO deployed | Browser not restarted | Fully close and reopen all browser windows |
| Usernames still blank in CyBlock logs | Policy not reaching computers | Run gpupdate /force and verify GPO is linked to the correct computer OU |
Policy not showing in edge://policy | Edge ADMX templates not installed | Install templates in the Central Store on your domain controller |
| Only some computers affected | GPO linked to wrong OU | Ensure the GPO is linked to the OU containing computer accounts, not user accounts |
Additional Notes
- This setting must be applied as a computer policy (
HKEY_LOCAL_MACHINE), not a user policy. - Multiple proxy addresses can be added separated by commas with no spaces.
- This change is part of Microsoft’s ongoing effort to phase out older authentication methods. Wavecrest will publish updated guidance as Microsoft’s rollout continues.
Disabling/Blocking QUIC Protocol in Your Network
Q: How can I disable QUIC for all employees using Windows Group Policy?
A: You can disable QUIC for employees using Group Policy settings for supported browsers like Google Chrome and Microsoft Edge. Here’s how:
- For Google Chrome:
- Open Group Policy Editor: Press Win + R, type gpedit.msc, and hit Enter.
- Navigate to Chrome Policies: Go to Computer Configuration or User Configuration > Administrative Templates > Google > Google Chrome.
- Set QUIC Policy: Find “Allows QUIC protocol” or “Experimental QUIC protocol”.
- Edit to set it to Disabled.
- Apply and Update: Click Apply, then OK. Use gpupdate /force or restart machines for immediate effect.
- For Microsoft Edge:
- Open Group Policy Editor: As above.
- Navigate to Edge Policies: Go to Computer Configuration or User Configuration > Administrative Templates > Microsoft Edge.
- Set QUIC Policy: Look for “Allows QUIC protocol”.
- Edit to set it to Disabled.
- Apply and Update: Click Apply, then OK. Update policy or restart machines.
Q: Can I block QUIC at the firewall level?
A: Yes, you can also block QUIC at your firewall by blocking UDP traffic on port 443:
- Firewall Configuration:
- Block UDP Port 443: Configure your firewall to block outgoing UDP traffic on port 443. This will effectively prevent QUIC traffic since QUIC typically uses UDP over this port.
- Considerations:
- Ensure this does not interfere with other necessary UDP traffic on the same port or other services that might use UDP 443.
- This approach will block QUIC for all applications, not just browsers, which might be more comprehensive but also more disruptive if not all UDP 443 traffic is intended to be blocked.
Q: How can I verify if the QUIC policy has been applied?
A:
- For Chrome: Navigate to chrome://policy/ in the browser to check if the QUIC policy is listed as “Disabled”.
- For Edge: Use edge://policy/ to confirm the policy setting.
Q: What should I consider when disabling or blocking QUIC?
A:
- Performance Impact: Disabling or blocking QUIC might affect browsing speed or functionality on websites optimized for QUIC.
- Policy Updates: Policy names or locations might change with browser updates; keep your GPOs and firewall rules updated.
- Fallback: Browsers will fall back to HTTP/2 or HTTP/1.1, potentially less performant.
- Network Level: Blocking at the firewall is a broad approach affecting all QUIC traffic, so careful planning is needed.
Q: Will disabling QUIC affect all applications?
A: No, browser policies mainly affect Chrome and Edge. Blocking at the firewall will impact all applications using QUIC on UDP 443.
How to configure syslog on FortiGate
Below are the steps that can be followed to configure the syslog server:
From the GUI:
- Log into the FortiGate.
- Select Log & Report to expand the menu.
- Select Log Settings.
- Toggle Send Logs to Syslog to Enabled.
- Enter the Syslog Collector IP address.
- Select Apply.
If it is necessary to customize the port or protocol or set the Syslog from the CLI below are the commands:
config log syslogd setting
set status enable
set server "192.168.1.19"
set mode udp
set port 514
end 
To establish the connection to the Syslog Server using a specific Source IP Address, use the below CLI configuration:
config log syslogd setting
set status enable
set server "192.168.1.19"
set source-ip "192.168.1.1"
set mode udp
set port 514
endThe source ‘192.168.1.1’ can be any IP address of the FortiGate’s interface that can reach the syslog server IP of ‘192.168.1.19’ in the above example.
The ping and ping-options command from the CLI can be used to check basic connectivity to the Syslog server from a specific source IP.
exec ping-options source 192.168.1.1
exec ping 192.168.1.19
PING 192.168.1.19 (192.168.1.19): 56 data bytes
64 bytes from 192.168.1.19: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 192.168.1.19: icmp_seq=1 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=2 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=3 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=4 ttl=255 time=0.1 ms
--- 192.168.1.19 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.2 msDisk Usage Warning
If you receive a “Disk Usage Warning” email, you can take several steps to manage this issue. Some solutions, like reducing the retention period, can be implemented on your own without needing support. However, if increasing storage capacity becomes necessary, please schedule a call with support for further assistance.
Cyfin or CyBlock Disk Usage Warning
Steps customers can take on their own:
- Navigate to: Data Management > Log Data Source > Delete.
- Adjust the time frame for scheduled deletions to reduce the amount of stored data. This cleanup process will run overnight.
- Alternatively, set the process to manual, choose “Delete”, and then revert to scheduled deletions after the cleanup.
Note: These actions will not affect any already ingested reporting data; This only remove the raw logs used during the data ingestion process.
Metric Server Disk Usage Warning
Your disk usage warning could be due to an increase in stored data during the retention period or because initial storage estimates were underestimates, consider the following options:
Option 1 (Steps customers can take on their own):
If you don’t want to allocate additional storage:
- Reduce the metric server’s storage limit to decrease retention time:
- Navigate to: Data Management > Report Database > Configuration > Settings.
- Reduce the storage limit (e.g., from 1 year to 6 months, from 6 months to 3 months, etc.).
Option 2 (Requires Assistance from Support):
If you want to maintain the existing retention period and need to increase storage based on current data growth:
- Schedule a call with support to help expand your currently configured storage.
Understanding Data Storage for Cyfin: Cloud and On-Premises Environments
When using Cyfin, it’s important to understand how we handle and store data, whether you’re running in our cloud environment or deploying an on-premises version. This article outlines the key points for both types of deployments and explains the storage of processed and enhanced data—not raw log data.
Data Processing and Storage in Cyfin
Cyfin’s primary function is to receive a syslog data stream from firewalls or other supported sources, and then process, parse, and enhance this data. During this process, Cyfin only ingests the specific fields required for analysis and reporting. Once the data is ingested, we apply compression and store only the valuable, enriched data used for generating employee-focused web usage reports that are manager and HR-friendly. Importantly, Cyfin does not store the original raw log files sent to us; instead, we store the processed and optimized data ready for reporting and analysis.
Cloud Environment Customers: Storage Options and Costs
If you are running Cyfin in our cloud environment, your data will be securely stored within the Cyfin metric cloud ecosystem. We offer two types of storage based on your operational needs:
- Cold Storage: This option is suitable for customers who do not require real-time access to their data. It offers a lower cost per gigabyte, though retrieval times may be slower. Cold storage is ideal for customers who initiate investigations based on internal requests rather than constant monitoring.
- Hot Storage: For customers who need faster access to their data, hot storage provides quicker retrieval times at a higher per-gigabyte rate. This option is best suited for customers who require immediate access to the data for monitoring or investigations.
You also have the flexibility to combine both hot and cold storage to optimize cost and performance based on your retention policy. For example, if your retention policy is one year, you could use hot storage for the first three months to ensure rapid access to more recent data for investigations, and cold storage for the remaining nine months, where quick access is less critical. This hybrid approach allows you to balance speed and cost depending on your data access needs over time.
Since each customer’s storage requirements can vary based on web resource usage and the fields we ingest, we recommend starting with a proof of concept to determine the actual storage required. To obtain an accurate storage estimate for your retention policy (such as one year), you will need to syslog your live data stream and allow Cyfin to ingest data for a sufficient period. This will give you a clearer idea of your peak and slow ingestion periods and help you properly estimate long-term storage needs.
On-Premises VM Customers: Provisioning Your Own Storage
For customers installing Cyfin on an on-premises virtual machine (VM), you will need to provision storage in your own environment. Similar to our cloud offering, you will be responsible for storing the processed and enhanced data, not the raw log files. We recommend evaluating the product by syslogging your live data stream over a period long enough to capture both peak and slow periods. This will help you estimate the storage needed to retain data for your required retention policy, typically one year.
Just like with our cloud-based offering, on-premises customers can also opt to combine hot and cold storage for a more tailored solution. For instance, you might provision hot storage for data you need immediate access to and cold storage for older data that you don’t access frequently, helping you manage costs without sacrificing performance when it matters most.
Conclusion
Understanding the storage requirements for Cyfin is essential for optimizing both cost and performance. Whether you choose our cloud-based storage options or an on-premises deployment, rest assured that only the processed and enhanced data is stored, and we can tailor storage solutions to fit your specific needs. You also have the flexibility to combine hot and cold storage to balance retrieval speed and cost over time. To accurately assess storage for your retention policy, it’s critical to evaluate Cyfin by ingesting live data over a suitable period. If you need assistance calculating storage requirements or determining the best storage solution for your setup, feel free to contact our support team.
No Usernames in SonicWall Reports? Here’s Why and How to Fix It
If your Cyfin reports and dashboards are only displaying IP addresses instead of usernames, it indicates that SonicWall is not authenticating users.
Why Are There No Usernames?
Cyfin relies on SonicWall to log usernames. When SonicWall does not authenticate users, only IP addresses are captured in the log data. As a result, Cyfin will show the IP address in place of a username.
How to Enable User Authentication in SonicWall
To report on actual usernames, user authentication must be enabled on your SonicWall firewall. Here’s how to ensure usernames are included in your logs:
- Configure Authentication Settings – Go to Users | Settings in your SonicWall appliance and set up an authentication method. Typically, this will be one of the following:
- LDAP + Local Users
- Active Directory Single Sign-On (SSO) using the SonicWall SSO Agent.
- Force User Authentication – After configuring authentication, you need to set access rules that require users to authenticate before traffic is allowed through the firewall. For detailed instructions, refer to the SonicWall Knowledge Base article How to Force User Authentication Prior to Allowing Traffic Through the Firewall.
- Verify AD SSO is Working – If you’re using Active Directory Single Sign-On, ensure it’s functioning correctly by following the test steps outlined at the end of the SonicWall guide.
By enabling authentication on your SonicWall, Cyfin will be able to log and display usernames, providing more meaningful and detailed reports.
How to Verify SonicWall is Authenticating Users
You can confirm whether SonicWall is logging usernames (independently of Cyfin) by checking SonicWall’s built-in log monitor. Follow these steps:
Step 1: Ensure SonicWall is Logging Internet Usage Events
- Go to Log | Settings and expand the Log | Syslog section.
- Click the Configure button next to Syslog Website Accessed events.
- Ensure that the option Display Events in Log Monitor is enabled and set the display interval to 0 seconds.
Step 2: Investigate Logs for User Authentication
- Navigate to Investigate | Event Logs.
- Filter the logs by:
- Priority = Inform
- Category = Log
- Source IP = (enter the IP address you want to check, such as your own for testing purposes).
This will display all web traffic for that IP address.
- Click the More Details button (three lines) next to any event to view additional details.
Step 3: Check the Username Field
In the event details, look for the Username field. If this field is blank, it means that the IP address in question is not being authenticated for web traffic.
Additional Support
If you need further help with authentication issues, it’s best to contact SonicWall support. When troubleshooting, show them the issue using the SonicWall log monitor as described above.
Once SonicWall is logging authenticated users, Cyfin Reporter will be able to match usernames with their corresponding Active Directory objects. This allows you to take advantage of features like reporting on Departments and Security Groups. For more information, see our article on SonicWall Reporting on Users, Departments, and AD Security Groups.
CyBlock Deployment Options
We understand that each organization has unique requirements for deploying web filtering and monitoring solutions. That’s why CyBlock offers flexible deployment options to meet your specific needs, whether you prefer an on-premise setup, a private hybrid cloud, or the Wavecrest Cloud platform. Below are the available deployment options and the benefits of each.
Virtual – Container (On-Premise or Private Hybrid Cloud)
Leverage the scalability and flexibility of virtual and container environments to deploy CyBlock within your infrastructure. This deployment option supports:
- VM Resources: Easily scale with virtual machine environments, ensuring you have the resources you need as your organization grows.
- VMware & VMware-Compatible Systems: Full support for VMware systems, making it a seamless addition to your existing virtual infrastructure.
- Microsoft Hyper-V: Compatible with Microsoft’s Hyper-V virtualization platform, allowing for easy integration and management.
- Container Environments: Take advantage of containerization with Docker support, providing fast deployment and improved scalability for hybrid or private cloud solutions, such as Azure.
This option provides maximum control over your data, privacy, and security while integrating directly with your existing IT infrastructure.
Wavecrest Cloud Platform (Cloud and Hybrid Cloud)
Enjoy the convenience and low maintenance of our cloud-hosted CyBlock solution. This deployment option is perfect for organizations looking to simplify IT management while maintaining the highest standards of security and compliance.
- Cloud Deployment: Deploy CyBlock in minutes with easy-to-follow, intuitive steps. This option requires no additional hardware or software, reducing complexity and minimizing maintenance costs.
- Secure Infrastructure: Benefit from our state-of-the-art data center, certified for SSAE 18, SOC 3, SOC 2 compliance, and audited for HIPAA and HITECH. Rest assured that your data is protected with the highest security and privacy standards.
- Hybrid Option: If you require a blend of on-premise and cloud solutions, CyBlock also supports hybrid deployments, allowing you to maintain control over specific resources while benefiting from the Wavecrest Cloud for other functions. This approach combines flexibility with efficiency, ensuring your deployment is tailored to your business needs.
With this option, you’ll enjoy continuous updates, enhanced security, and seamless access to our U.S.-based support team.
Cyfin Deployment Options
At Wavecrest, we understand that every organization has unique needs when it comes to deploying web monitoring and reporting solutions. That’s why Cyfin offers multiple deployment options that allow you to seamlessly integrate our solution into your existing infrastructure or leverage the cloud for a simplified, maintenance-free experience. Below, we outline the available deployment choices and their respective benefits:
1. Virtual – Container (On-Premise or Private Hybrid Cloud)
Virtual – Container
With Cyfin’s virtual and container-based deployment options, your organization can leverage highly scalable and easily expandable VM resources, perfect for environments requiring flexibility and growth potential. Cyfin supports popular virtualization platforms such as:
- VMware & VMware-Compatible Systems: Deploy Cyfin quickly and efficiently using our pre-packaged VMware OVA Template, designed for seamless integration into any VMware environment. Whether you’re running VMware natively or a compatible system, Cyfin’s VM deployment is tailored for easy integration.
- Microsoft Hyper-V: If your infrastructure is built around Hyper-V, Cyfin’s Windows Hyper-V Installer makes installation simple and ensures a smooth setup process. Our Hyper-V deployment is designed to meet your specific infrastructure needs with minimal hassle.
- Container Environments (Docker): For organizations leveraging containerized environments, Cyfin offers Docker support, enabling lightweight, portable deployments that can easily adapt to evolving infrastructure requirements.
Benefits:
- Flexible scalability and resource optimization
- Integration support for major VM and container environments
- No need for specialized hardware, reducing upfront costs
- Tailored deployment to suit your unique infrastructure
2. Wavecrest Cloud Platform Deployment
Cloud-Based Solution
Experience the convenience and security of deploying Cyfin on the Wavecrest Cloud Platform, designed to simplify the deployment process while delivering advanced web monitoring and reporting capabilities.
Cyfin’s cloud deployment offers:
- Quick Deployment: Start monitoring in minutes with a step-by-step setup process that requires no additional hardware or software.
- Zero Maintenance: Our cloud-based platform takes the burden of ongoing maintenance and updates off your IT team, letting you focus on what matters most.
- SSAE 18, SOC 3, SOC 2 Certified Infrastructure: Cyfin’s cloud services are backed by top-tier certifications, ensuring data security and compliance with HIPAA and HITECH standards.
Benefits:
- No additional infrastructure required
- Reduced operational and maintenance costs
- Fast, intuitive deployment process
- Industry-leading security and compliance certifications
Each option offers distinct advantages, whether you’re looking for on-premise control with VM or container environments or the ease and reliability of our cloud-based platform. Our team is here to help guide you in selecting the best deployment method for your organization.