Web Gateway 7.1.5 Product Guide - McAfee

Monitoring
Error handling 8
Handle Update Incidents
This nested error handling rule set handles measures taken when an incident occurs that involves
updates performed on the appliance.
Nested error handling rule set — Handle Update Incidents
Criteria — Incident.OriginName equals “Updater” OR Incident.ID
equals 299 OR Incident.ID equals 298
The rule set criteria specifies that the rule set applies when the update module is specified by the value
of the Incident.OriginName property or the value of the Incident.ID property is within the range of
incidents that involve the update module.
The rule set contains the following rules:
Create update incident message
Always –> Continue — Set User-Defined.eventMessage =
“Update Event triggered [“
+ Number.ToString (Incident.ID)
+ “]:”
+ Incident.Description
+ “; origin:”
+ Incident.OriginName
+ “; severity:”
+ Number.ToString (Incident.Severity)
The rule is always executed when the criteria of its rule set is matched. The rule then uses an
event to set a user-defined property to a chain of values that make up a message text on the
update incident. The message includes values for several incident properties.
The Continue action lets processing continue with the next rule.
Create syslog entry and other rules
Always (or other criteria) –> Continue — ...
The Create syslog enty rule and other rules in the rule set use different events to take measures if
the respective rule criteria is matched.
Note: These rules are not enabled by default.
McAfee Web Gateway 7.1.5 Product Guide 311