Web Gateway 7.1.5 Product Guide - McAfee

4
Rules and rule sets
About rule elements
Complex criteria
The criteria of a rule can be made complex by configuring it with two or more parts. Each of the parts
then has a property with operator and operand. The parts are linked by AND or OR.
The following is an example of complex criteria:
AND/OR Property Operator Operand
URL.Categories at least one in list Drugs
OR URL.Categories at least one in list Games/Gambling
The criteria is matched if a filtered URL belongs to a category that is on any of the two specified
category lists (or on both).
If you configure criteria with three or more parts and use both AND and OR between them, you also
need to put brackets to indicate how the parts are logically connected. For example, (a AND b) OR c
differs in meaning from a AND (b OR c).
When you add a third criteria part on the user interface, lowercase letters appear before the parts and
an additional field is inserted at the bottom of the configuration window.
The field displays your criteria parts in short, for example, a AND b OR c. You can then type brackets
into the field as needed.
ID AND/OR Property Operator Operand
a URL.Categories at least one in list Drugs
b AND URL.Categories at least one in list Games/Gambling
c OR Antimalware.Infected
Criteria Combination (a AND b) OR c
Properties
A property is a key element in every rule. If it has a particular value, the criteria of the rule is matched
and the rule applies, which means that the rule action is triggered.
For example, if the property Antimalware.Infected has the value true in the criteria of a particular rule
for virus and malware filtering, the rule triggers its blocking action.
A property in a rule is a property of a web object or of something that is related to a web object, such
as the user who requests it. For example, Antimalware.Infected is the property of a web object that is
requested by a user or sent in response by a web server or embedded in another object.
A property has a name, a type, and a value. For every property, a particular range of values is possible.
A value within this range is found for it during the filtering process by running a special module or by
going through a particular list.
In the following, some examples of properties are given.
Property of a web page or a file
Property — Antimalware.Infected
Type — Boolean
Values — true | false
The meaning of this property can be paraphrased as “being infected by a virus or other malware”.
A rule using this property could apply if its value is true. The Anti-Malware module scans web objects
when the rule is processed to find out what the value of the property is.
88 McAfee Web Gateway 7.1.5 Product Guide
equals true