Does Elements Web Content Control feature have an alert only or report only mode?

Issue:

Does Elements Endpoint Protection Web Content Control feature have an alert only or report only mode? When Block is disabled for a category and only Alert is enabled, an alert is not sent to the Security Events page when a user visits a website belonging to that Web Content Control category.  

Resolution:

Elements Endpoint Protection Web Content Control feature does not have an "Alert only" or "Report only" -mode

What you are seeing is the expected behaviour of Web Content Control in WithSecure Elements Endpoint Protection: a security event is only generated when access to a category is actually blocked. When a category has Alert turned on but Disallowed (block) turned off, the site is allowed and no security event or device notification is created.

In practice the supported combinations are therefore Block only (Disallowed on, Alert off) and Block with Alert (Disallowed on, Alert on). An alert-only or monitoring mode for discovering which categories are being accessed without blocking them is not currently available. 

If you would like to assess the impact before enforcing a category across the environment, one option is to apply a profile with Disallowed and Alert enabled to a small pilot group of devices and review the resulting Web Content Control security events before rolling it out more widely.