Please refer, the below script monitor to generates alert if any Unauthorised Website has accessed on end point.
Note: In function def URL(),you need to give the website names which you need to check whether the endpoint user has opened it or not.
The script should run every 5min, so it can easily trigger the alert if that website is opened.
Tested OS : This script has tested on Windows(7), Windows(8,8.1), Windows(10) Machines
Please refer the wiki guide for how to use the custom monitoring scripts: