Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
Virus and malware filtering
Rules for virus and malware filtering
Rules that filter web objects for infections are contained in a virus and malware filtering rule set. This
section explains these rules and describes a library rule set.
A virus and malware filtering rule set typically includes a blocking rule that blocks access to infected
objects. It can also include rules for whitelisting web objects, such as URLs, media types, and others,
that should not be filtered to avoid getting blocked eventually.
The whitelisting rules are placed before the blocking rule, so they are processed before it. If a
requested object is on one of the whitelists, the corresponding rule applies. It stops the processing of
the rule set, so the blocking rule is not processed and cannot apply.
A rule set like this is included when the wizard creates a system of rule sets. It is also included in the
default system.
Rule sets for virus and malware filtering differ from each other mainly with regard to their whitelisting
rules, which can cover different types of web objects and use different whitelists. They do not differ,
however, in their fundamental structure, which combines a blocking rule with one or more whitelisting
rules that are processed before it.
View the implemented virus and malware filtering rules
The virus and malware filtering rules that are implemented on the appliance can be viewed on the user
interface.
1 Go to Policy | Rule Sets.
2 On the rule sets tree, select the rule set that contains the virus and malware filtering rules, which is
by default named Gateway Antimalware. The individual rules appear on the settings pane.
3 On the settings pane, click Show Details. Rule conditions and events are displayed for each rule.
You can modify these rules, copy and paste them, delete them, and also create your own rules.
172 McAfee Web Gateway 7.1.5 Product Guide