Web Gateway 7.1.5 Product Guide - McAfee

Rules and rule sets
Rule configuration 4
Information about URL categories is retrieved by a special module from a Global Threat Intelligence
server. The settings of this module are therefore specified in the criteria of the rule. You can configure
these settings to modify the way the module retrieves the information, for example, by using Global
Threat Intelligence information retrieved earlier on and stored in a local database of the appliance. This
can reduce latency.
Action
If the URL belongs to a category on the blocking list, the blocking action is executed. The settings of the
action specify that a block message is sent to the user who requested the URL and is affected by the
blocking action.
Process flow
The blocking action also stops the filtering process completely. When the request for the URL is
received on the appliance, it is processed in the request cycle. Since the request is not forwarded to a
web server, no response needs to be processed and looking for embedded objects that might have
been sent with a request is also not needed because the request is blocked anyway.
Processing can therefore be stopped completely. It continues when the next request is received on the
appliance.
Block if virus was found (Sample rule)
This rule can be included in a rule set for virus and malware filtering.
Rule
Name
Block if virus was found
Criteria Action
Antimalware.Infected equals true –> Block
In plain text, the rule could be rendered as follows:
If a web object is infected, block it.
Purpose of the rule
This is a key rule of the filtering process on the appliance. It blocks access to web objects that are
infected by viruses or other malware. It blocks this access in all cycles of the process.
Whether an infected object is sent by a web server in response to a user request, or a user requests to
upload an infected object from your network to the web, or an infected object is sent embedded with a
request or response, all these attempts are blocked by the rule.
Property and criteria
The property used in the rule is Antimalware.Infected, which means “infected by a virus or other
malware”. To detect an infection in a web object, a special module is needed, the Antivirus module (or
engine). Settings for the modules are specified with the property.
Action
The blocking action that is executed if an infected object is detected affects the user who sent a request
for access to the object. The action settings therefore specify that a message is sent to inform the user,
in the same way, as it is done when a request is blocked by a URL filtering rule.
Process flow
Like in URL filtering, the blocking action of the virus and malware filtering rule stops the filtering
process completely. When the next request is received on the appliance, the process continues.
McAfee Web Gateway 7.1.5 Product Guide 107