Web Gateway 7.1.5 Product Guide - McAfee

Adding the action
9 Select Action. Items for adding an action appear in the main window area.
10 Add an action with special settings (Block):
a From the Action list, select Block.
b From the Settings list, select Virus Found.
Rules and rule sets
Rule configuration 4
Under these settings, a block message is sent to the user who requested an object when the
object is blocked.
Reviewing the rule
11 Skip the Events step and select Summary to review what you have configured.
Completing the sample configuration
12 Click Finish. The Add Rule window closes and the new rule appears in the Gateway Antimalware rule
set.
Note: The rule is grayed out because it is not enabled.
13 Click Save Changes.
For more information, see About rule sets, Adding a rule, and Block if virus was found (Sample rule).
Sample rules
This section explains in detail three sample rules from the library rule sets of the appliance:
• Do not filter URLs in Global Whitelist
• Block URLs whose category is in Category BlockList
• Block if virus was found
Note: The Block if virus was found rule is also used in another section of this guide as an example for
explaining step by step how a rule is created. For more information, see Create a sample rule.
Do not filter URLs in Global Whitelist (Sample rule)
This rule can be included in rule set for global whitelisting.
Rule
Name
Do not filter URLs in Global Whitelist
Criteria Action
URL matches in list GlobalWhitelist –> Stop Cycle
In plain text, the rule could be rendered as follows:
If a URL is on a particular global whitelist, stop the current processing cycle.
Purpose of the rule
The rule is implemented to provide you with a means of ensuring that particular URLs can be accessed
by the users of your network and are not blocked by any other rules. To achieve this, URLs are entered
on a whitelist. If a whitelist URL is requested, the rule stops processing the request cycle. This means
all following rules of this cycle, including those that might eventually block the URL, are not processed.
When this rule and its rule set are implemented in a rule set system, it should obviously be placed at
the beginning of the system to ensure there are no rule sets before it that block URLs. In this case, the
whitelisting rule is truly global. It overrules all other measures that might be taken for URLs by the
implemented rule set system.
McAfee Web Gateway 7.1.5 Product Guide 105