Web Gateway 7.1.5 Product Guide - McAfee

Web filtering
Media type filtering 6
Media type filtering properties
Most of the media type filtering rules in a library rule set use the MediaType.EnsuredTypes property.
There are several other properties, however, which let rules behave differently when included in their
criteria.
There is, for example, the MediaType.NotEnsuredTypes property. If you use this property in the criteria
of a blocking rule, the rule blocks media whose types are on a blocking list even if the probability that
they actually are of this type is less than 50%. You could do this if you wanted to make sure a media
type gets blocked under all circumstances.
The following table lists the properties of the rules in a library rule set for media type filtering.
Table 6-8 Media type filtering properties
Property Description
MediaType.EnsuredTypes Property of media that have their types ensured with a probability of more than
50%
This level of probability is assumed if a media type signature from an internal list
on the appliance can be found in the object code of the media.
MediaType.NotEnsuredTypes Property of media for which the probability that they actually are of their respective
types is less than 50%
MediaType.FromFileExtension Property of media for which types are assumed based on the extensions of the
media type file names
Extensions and the media types associated with them are looked up in an internal
catalog on the appliance. There are, however, extensions that are used by more
than one media type.
MediaType.FromHeader Property of media for which types are assumed according to the content type field
of the headers sent with the media
Headers are read and evaluated in a standardized format. To filter headers in their
original formats, you can use the Header.Get property.
MediaType.IsSupported Property of embedded or archived media that can be extracted by the opener
module of the appliance.
List.OfMediaType.IsEmpty Property of media with types that are not on an internal list
For information on other properties, see the List of properties in the appendix. For a procedure to let a
rule use a different property, see Modifying a media type filtering rule.
Processing data in MIME format
Web objects can be filtered on the appliance when they are multi-part objects transmitted in MIME
(Multi-Purpose Internet Mail Extension) format, which is used for data sent in POST messages. Several
MIME type filtering properties are available for configuring within filtering rules.
The MIME format provides a header and header parameters for each part of a multi-part object, for
example, for each member of an archive. The information contained in a MIME header and its
parameters specifies the type of the object in question. The format is also known as
multipart/form-data format.
You can use the Composite Opener module of the appliance in a rule to open multi-part objects that are
transmitted in MIME format and extract individual parts from it. You can then block or allow these parts
depending on whether a particular header or header parameter is sent with them, or depending on the
value that a header or header parameter has.
You can set up rules for this using special MIME data filtering properties. These rules are similar to the
ones you can use for media type filtering.
McAfee Web Gateway 7.1.5 Product Guide 201