Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
Virus and malware filtering
Allow URL hosts that match in list Antimalware URL Whitelist
URL.Host matches in list Antimalware URL Whitelist –> Stop Rule Set
The rule uses the URL.Host property to check whether a given URL matches one of the entries on
the specified whitelist. If it does, processing of the rule set stops and the blocking rule is not
processed.
You can use this rule to exempt web traffic from filtering when the hosts of the URLs involved are
well-known web servers for which it is safe to assume that they spread no viruses and other
malware. Whitelisting increases performance because it avoids the effort of scanning the
respective web objects.
Allow streaming media from list Antimalware Media Whitelist
(URL Categories contains Streaming Media OR
URL Categories contains Internet Radio / TV OR
URL Categories contains General News)
AND MediaType.Ensured all in list Antimalware Media Type Whitelist –> Stop Rule Set
The rule uses the URL.Categories property to check whether a given URL belongs to Streaming
Media or related categories. The URL Filter module, which is called to retrieve category
information, runs with the Default settings, as specified with the property.
The second part of the criteria uses the MediaType.Ensured property to check if the media type of
a web object is found on the specified whitelist.
If the URL belongs to one of the categories in question, and the web object that is located by the
URL is of a media type that is on the whitelist, processing of the rule set stops and the blocking
rule is not processed.
The Anti-Malware module scans complete files, which means it waits for the end of data
transmission before starting the scan. As streaming media is by nature an endless stream of data,
the Anti-Malware module would wait forever. However, the risk that streaming media will contain a
virus or other malware is very low. Therefore, streaming media can be exempted from scanning.
Block if virus was found
Antimalware.Infected equals true –> Block
— Statistics.Counter.Increment (“BlockedByAntiMalware”,1)
The rule uses the Antimalware.Infected property to check whether a given web object is infected
by a virus or other malware. The Anti-Malware module, which is called to scan the object runs with
the Gateway Antimalware settings, as specified with the property. These settings let the module
use all its three submodules and their methods to scan web objects.
If the module finds that a web object is infected, processing of all rules stops and the object is not
passed on any further. Access to it is blocked this way. In a request cycle, the infected web object
is not passed on to the web. In the response and embedded object cycles, it is not passed on to
the user who requested it.
The action settings specify a message to the requesting user.
The rule also uses an event to count blocking due to virus and malware infections. The event
parameters specify the counter that is incremented and the size of the increment. The event
settings specify the settings of the Statistics module, which executes the counting.
176 McAfee Web Gateway 7.1.5 Product Guide