Enterprise GenAI Blocklist
Category-Based Blocking at Scale

# GenAI Acceptable Use Policy — Enforcement Rules
# Load into your proxy / SWG policy engine

# TIER 1: Approved GenAI tools (enterprise agreements in place)
rule genai_tier1_allow {
    match: domain_list("/feeds/genai_approved.txt")
    action: ALLOW
    log: true
    dlp_scan: true
    note: "Approved GenAI — log all usage, DLP scan uploads"
}

# TIER 2: Conditionally approved (allowed for non-sensitive data only)
rule genai_tier2_conditional {
    match: domain_list("/feeds/genai_conditional.txt")
    action: ALLOW
    condition: dlp_classification NOT IN [
        "Confidential", "Restricted",
        "PII", "Financial", "Legal_Privileged"
    ]
    on_violation: BLOCK + alert("security-ops")
    log: true
    note: "Conditional GenAI — block if sensitive data detected"
}

# TIER 3: Prohibited GenAI tools (all uncategorized / high-risk)
rule genai_tier3_block {
    match: domain_list("/feeds/genai_block.txt")
    action: BLOCK
    response: redirect("/policy/genai-blocked.html")
    log: true
    alert: threshold(3, "5m") -> alert("security-ops")
    note: "Blocked GenAI — alert if 3+ attempts in 5 minutes"
}

#!/usr/bin/env python3
"""Generate a GenAI usage intelligence report from blocklist logs."""

import json
from collections import Counter, defaultdict
from datetime import datetime, timedelta

def parse_enforcement_logs(log_path: str, days: int = 30) -> list:
    """Parse proxy/firewall enforcement logs for GenAI block events."""
    cutoff = datetime.now() - timedelta(days=days)
    events = []
    with open(log_path) as f:
        for line in f:
            record = json.loads(line)
            ts = datetime.fromisoformat(record["timestamp"])
            if ts >= cutoff and record.get("policy_action") == "BLOCK":
                events.append(record)
    return events

def build_report(events: list, ai_categories: dict) -> dict:
    """Aggregate blocked GenAI events by category and department."""
    by_category = Counter()
    by_dept = defaultdict(lambda: Counter())
    top_domains = Counter()
    repeat_users = Counter()

    for evt in events:
        domain = evt["destination_domain"]
        category = ai_categories.get(domain, {}).get("category", "Unknown")
        dept = evt.get("user_department", "Unknown")

        by_category[category] += 1
        by_dept[dept][category] += 1
        top_domains[domain] += 1
        repeat_users[evt.get("username", "unknown")] += 1

    return {
        "period": f"Last 30 days ({datetime.now():%Y-%m-%d})",
        "total_blocked": len(events),
        "by_category": by_category.most_common(),
        "by_department": dict(by_dept),
        "top_blocked_domains": top_domains.most_common(20),
        "repeat_offenders": [
            (u, c) for u, c in repeat_users.most_common(10)
            if c >= 5
        ],
    }

# Generate and output the report
events = parse_enforcement_logs("/var/log/proxy/enforcement.jsonl")
report = build_report(events, ai_categories={})
print(json.dumps(report, indent=2, default=str))