Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
Virus and malware filtering
Virus and malware filtering rules
This section explains in detail a blocking rule and a whitelisting rule for virus and malware filtering.
Note: The rules are shown here in a notation that comes close to how they appear on the user interface.
Blocking rule
The following is an example of a blocking rule for virus and malware filtering.
Name
Block if virus was found
Criteria Action
Antimalware.Infected equals true –> Block
In plain text, this rule can be rephrased as follows:
If an object is infected by a virus or other malware, block access to it.
The key element in the rule criteria is Antimalware.Infected. It is the property that is checked for a
given web object. Antimalware.Infected is (“equals”) true if the object is actually infected by a virus or
other malware. The Antimalware module is called to find out whether this is the case. If it is, the criteria
is matched and the rule applies. The rule then executes its action, which is the Block action. It blocks
access to the object.
The Antimalware.Infected property has the Gateway Antimalware settings specified for it. This means
the module that scans objects for infections runs with these settings. The settings determine, for
example, which methods are used for the scanning.
The Block action also has settings specified for it. These settings determine that a message is sent to a
user who is affected by the action and what this message looks like. For this virus and malware filtering
rule, the Virus Found settings are specified, which means that the message mentions an infection of the
requested object as the reason for the blocking.
Whitelisting rule
The following is an example of a whitelisting rule for virus and malware filtering.
Name
Do not filter specific URLs
Criteria Action
URL matches in list Antimalware.URL Whitelist –> Stop Rule Set
In plain text, this rule can be rephrased as follows:
If a URL matches one of the entries on the whitelist for virus and malware filtering, do not process
the virus and malware filtering rule set any further.
The property in the rule criteria is URL. When the rule is processed, it is checked for a given URL
whether it matches one of the entries in the list (“matches in list”) that is specified in the criteria as the
Antimalware.URL Whitelist. If it does, the criteria matches and the rule applies.
The rule then executes the Stop Rule Set action, which stops processing of the virus and malware
filtering rule set and lets all rules of the rule set that follow this whitelisting rule be skipped, including
the blocking rule (if placed behind this rule).
174 McAfee Web Gateway 7.1.5 Product Guide