Web Gateway 7.1.5 Product Guide - McAfee

Property of a URL
Property — URL.Categories
Type — List of categories
Values — Lists of URL categories
Rules and rule sets
About rule elements 4
The meaning of this property can be paraphrased as “belonging to (one or more) URL categories”.
A rule using this property could apply if one of these categories is on a blocking list. The URL Filter
module retrieves information from the Global Threat Intellegience on which category or categories a
given URL belongs to.
Property of a website or page
Property — URL
Type — String
Values — Lists of URLs
The meaning of this property can be paraphrased as “having a URL”.
A rule using this property could apply if a URL is on a blocking list. During the filtering process, it is
looked up whether the URL is on the list. No special module is needed for this lookup.
For a list of available properties with explanations, see the List of properties in the appendix.
Actions
An action is the element of a rule that is executed if the criteria of the rule is matched.
For example, if an object sent by a web server in response to a user request is found to be
virus-infected, the criteria of a particular rule for virus and malware filtering is matched, and the rule
triggers the Block action.
Settings can be configured for some actions to determine the way they are executed. For example, the
Block action has settings that specify a corresponding user message. The settings can also specify the
blocking reason for logging purposes.
Every action has an impact on the filtering process. This process can be stopped by an action, or the
remaining rules in a rule set or cycle are skipped when an action has been executed, or the process just
continues after an action.
In the following, some examples of actions are given.
Action — Block
Settings — Specifying a message template and the blocking reason
Impact — Stops the filtering process
The blocking effect of this action is achieved by stopping the filtering process. If, for example, a request
is blocked, processing stops completely and the request is not passed on to the appropriate web server.
The user who sent the request is informed of the blocking. Different settings can be configured for the
action, according to whether the blocking reason was a found virus or an inappropriate URL category,
or something else.
Action — Stop Rule Set
Settings — None
Impact — Stops processing of the current rule set and lets processing
continue with the next rule set.
This action can be used by a whitelisting rule to skip a blocking rule that follows it in the same rule set.
Since this action does not affect the user, no settings for a user message are required.
McAfee Web Gateway 7.1.5 Product Guide 89