diagnose_url_access
Diagnose why a URL is blocked or allowed by checking custom categories, PAN-DB, security rules, URL filtering profiles, and recent logs to identify the exact cause and avoid duplicate category proposals.
Instructions
[READ-ONLY] Full analysis of why a URL is blocked/allowed: existing custom categories covering it (or same-domain entries that do not match), PAN-DB category, rules and URL filtering profiles using those categories, recent URL logs for the user, and conclusions. Prevents proposing a category that already exists.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL or hostname, with or without scheme (e.g. 'https://app.example.com/login') | |
| user | No | User name, with or without domain (e.g. 'jdoe' or 'corp\\jdoe') | |
| device | No | Specific firewall; usually omit it. | |
| period | No | Relative time window on receive_time (default: last-24-hrs) | |
| src_ip | No | IP address | |
| firewall | No | Panorama entry from firewalls.json. Optional when a single Panorama is configured. | |
| device_group | No | Device group of the user's site. Inferred from the user's logs when omitted. |