Web Gateway 7.1.5 Product Guide - McAfee

URL filtering
Web filtering
URL filtering 6
The appliance filters URLs to block inappropriate or malicious content. This section gives an overview of
the URL filtering process and describes how you can modify it.
URL filtering process
Several elements work together in the URL filtering process on the appliance. These include:
• Filtering rules that control the process
• A whitelist and blocking lists that are used by rules to exempt some URLs from filtering and block
others
• The URL filter module, which is called by suitable rules to retrieve information on URL categories and
reputation scores from the Global Threat Intelligence system
Filtering rules
The rules that control the URL filtering process are contained in a URL filtering rule set. One of these
rules says, for example, that access to a URL is blocked if it matches an entry on a blocking list.
Another rule blocks URLs if they belong to a category that is on a blocking list. This rule calls the URL
filter module to retrieve category information for URLs from the Global Threat Intelligence system.
Another rule works in a similar way to block URLs that have a bad reputation.
A whitelisting rule exempts URLs from filtering if they match entries on the list used by the rule. This
rule is placed and processed before the blocking rules. If it applies, the blocking rules are skipped and
no URL filtering is performed for the whitelisted objects.
You can review these rules, modify or delete them, and also create your own rules.
For more information, see Rules for URL filtering.
Whitelist and blocking lists
A whitelist is used by a whitelisting rule to let particular URLs skip the blocking rule, which means there
is no URL filtering for these objects.
Note: Since a URL filtering rule set handles only URL filtering, whitelists are not needed for several types of
objects as they are in virus and malware filtering.
Blocking lists are used by rules for blocking URLs according to the categories they belong to or because
they match an entry on a list. Each of the blocking rules uses its own list.
You can add entries to these lists or remove entries. You can also create your own lists and let them be
used by the whitelisting rules.
For more information, see Whitelist and blocking lists for URL filtering.
Filter module
The module for URL filtering retrieves information on URL categories and reputation scores from the
Global Threat Intelligence system that is maintained by McAfee. Based on this information, blocking
rules block access to URLs. The module name is URL Filter.
You can configure settings for this module, for example, to let it include category information retrieved
from an Extended List that you provide or to perform a DNS lookup for URLs and include the
corresponding IP address in the search for category information.
For more information, see Module for URL filtering.
McAfee Web Gateway 7.1.5 Product Guide 187