Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
URL filtering
Allow uncategorized URLs
List.OfCategory.IsEmpty(URL.Categories) equals true –> Stop Rule Set
The rule uses the List.OfCategory.IsEmpty property, which has the URL.Categories property as a
parameter, to check whether the list of categories for categorizing a URL is empty. This would
mean that the URL is uncategorized, as it could not be assigned to any of the existing categories.
Specifying the URL.Categories property as a parameter ensures that it is a particular list of
categories that is checked. It is the list that is the value of this property.
To provide a list of categories as the value for the URL.Categories property, the URL Filter module
is called, which retrieves this list from the Global Threat Intelligence system. The module runs with
the specified Default settings.
If a URL is uncategorized, processing of the rule set stops and the blocking rules that follow this
rule are not processed. The request for the URL is forwarded to the appropriate web server and,
unless access to the URL is blocked in the response or embedded object cycle, the user is allowed
to access the web object that was requested by submitting the URL.
For information on how to modify this rule to let it execute a block action, see Modify a filtering rule
to block uncategorized URLs.
Block URLs whose category is in URL Category BlockList
URL.Categories at least one in list Category BlockList –> Block
— Statistics.Counter.Increment (“BlockedByURLFilter”,1)
The rule uses the URL.Categories property to check whether one of the categories a given URL
belongs to is on the specified blocking list. The URL Filter module, which is called to retrieve
information on these categories, runs with the Default settings, as specified with the property.
If one of the URL’s categories is on the list, processing of all rules stops and the request for access
to the URL is not passed on to the appropriate web server. Access to it is blocked this way.
The URLBlocked action settings specify that the user who requested this access is notified of the
blocking.
The rule also uses an event to count blocking due to URL filtering in the same way as the blocking
rule for individual URLs in this rule set.
Block URLs with bad reputation
URL.IsHighRisk equals true –> Block — Statistics.Counter.Increment
(“BlockedByURLFilter”,1)
The rules uses the URL.IsHighRisk property to find out whether a URL has a reputation that lets
access to it appear as a high risk. If the value for this property is true, processing of all rules stops
and the request for access to the URL is not passed on to the appropriate web server. Access to it
is blocked this way.
The reputation score is retrieved by the Global Threat Intellegence module, which runs with the
settings specified after the property.
The URLBlocked action settings specify that the user who requested this access is notified of the
blocking.
The rule also uses an event to count blocking due to URL filtering in the same way as the blocking
rule for individual URLs in this rule set.
190 McAfee Web Gateway 7.1.5 Product Guide