What To Look For? clauses

What To Look For? clauses look for conditions that must be met to trigger a content rule. Content rules can consist of more than one predefined What To Look For? clause. If a content rule contains multiple clauses, web traffic must meet all the specified conditions, otherwise, the content rule will not be triggered.

This topic contains a brief overview of all the What To Look For? clauses Secure Web Gateway uses in content rules.

What To Look For?

• Always Trigger the Rule

  The Always Trigger the Rule clause specifies that the content rule must always be triggered.

  You cannot edit this clause.

• Analyze Properties

  The Analyze Properties clause looks for a Document Properties expression list in attached files and documents. These lists match specific string values with specific document properties. See About Document Properties for more information.

  The Analyze Properties clause is used in the Analyze Properties content rule template.

• Bypass Rule

  The Bypass Rule clause enables you to bypass sanitization or redaction on a content rule for any signed document. Sanitization or redaction will not be attempted on signed documents if the Bypass Rule for signed documents check box is selected.

  Bypass Rule applies to the following content rules:

  • Redact Text
  • Sanitize Active Content
  • Sanitize Document Content

  Bypass Rule only affects signed documents. The Gateway will continue to apply unsuccessful redaction to signed messages, even when this check box is selected.

• Classification Level

  The Classification level specifically relates to values that are assigned to items that have been registered on an IG Server.

  The disposal action will trigger where content passing through the Gateway is matched to content registered on the IG Server, and where the Classification level for the item as set on the IG server is equal or exceeds the level set on the Gateway.

  If this value is set to 0 on your Gateway, matches to any IG registered items will trigger the disposal action.

  The Classification Level The Classification Level specifically relates to values that are assigned to items that have been registered on an IG Server. The disposal action will trigger where content passing through the Gateway is matched to content registered on the IG Server, and where the Classification level for the item as set on the IG server is equal or exceeds the level set on the Gateway. If this value is set to 0 on your Gateway, matches to any IG registered items will trigger the disposal action. clause is used in the Check Registered Data content rule template.

• Data Transfer Restriction

  The Data Transfer Restriction clause identifies large file transfers and excludes them from content scanning when used with the Size Bypass content rule.

  The default threshold value is 2,040 MB (2GB), but you can configure the threshold value. File transfers which are larger than this threshold value will not be scanned.

• Detect Malformed Data

  The Detect Malformed Data content rule enables you to handle transactions that might include malformed data. For example, you might want to block any downloads identified as containing 'malformed data'.

  The Detect Malformed Data content rule operates on selected Media Types. You can exclude or include certain types (such as PDF) using a combination of Detect Malformed Data content rules.

• Direction To Apply

  The Direction To Apply clause looks for data that is either entering or leaving your organization. You can use this clause to restrict a content rule to search for outbound or inbound items.

  You can configure a content rule to apply, where the item was detected...

  • either leaving or entering the company
  • leaving the company (uploading)
  • entering the company (downloading)

  Applying policy to inbound web traffic can have a negative impact on the performance of your Gateway.

• Document Contents

  The Document Contents clause looks for meta data included in documents detected by a Sanitize Document Content rule. You can configure the rule to search for:

  • Previous revision history
  • Comments

• Document Properties

  The Document Properties clause looks for information contained in the meta data of an attachment or document. You can use this clause to scan a file for user information, revision history, subject matter or any custom document properties belonging to a file.

  For more information, refer to Document Properties clause.

• Download Size Restriction Of

  The Download Size Restriction Of clause specifies the maximum size of files that can be downloaded.

  You can configure the size limit by entering a value in Download Size Restriction Of clause. The default value is 2MB. If a download exceeds the size limit, the download will be aborted.

  For more information, refer to Download Size Restriction Of clause.

• Lexical Expression

  The Lexical Expression clause looks for words, phrases or specified Lexical Expressions. The clause uses Lexical Expression Lists as a reference and can be used to detect phrases that violate your security policy.

  For more information, refer to Lexical Expression clause.

• Request or response has failed to be processed

  The Request or Response has Failed to be Processed clause looks for failures to process a request or a response by the policy engine. The content rule can be configured to generate an inform or block the communication in a controlled manner.

• Run External Command

  The Run External Command clause looks for details of the executable program that the Gateway is to run. See Run external command content rule for more information.

• Scan text extracted from images (OCR)

  Scan text extracted from images (OCR) enables you to extract and scan text from images, optionally including QR codes and barcodes, by using OCR (Optical Character Recognition) technology.

  You can configure the OCR settings from System > Gateway Settings > Policy Engine Settings. See Advanced and OCR for more information.

  Applying Scan text extracted from images (OCR) to inbound web traffic can have a significant impact on performance. We recommend that you apply OCR to outbound traffic only.

• Search Request Detection

  The Search Request Detection clause looks for requests made to a SafeSearch capable site.

  This clause is specifically designed to identify search requests to Google, Yahoo! and Bing. You cannot edit this clause.

• Size Restriction

  The Size Restriction clause detects files that violate a specified size limit.

  The Size Restriction clause is often used in conjunction with the Which Media Types clause. For example, you can create a Detect media types content rule that detects large image files.

  You can:

  • Configure a size limit between 0 and 2,097,150 KB (2.1 GB)

  • Configure the size limit as either a maximum or a minimum value. For example, applying a restriction of 1,000,000 KB or more detects files smaller than 1 GB.

• Spyware Call Home

  The Spyware Call Home clause looks for any existing spyware which is attempting to 'call home' by contacting computers outside your organization.

  You cannot edit this clause.

• Tracking Cookie Detection

  The Tracking Cookie Detection clause looks for cookies which track spyware in traffic in and out of your organization.

  You cannot edit this clause.

• URLs and Hyperlinks

  The URLs and Hyperlinks clause looks for specific URLs or hyperlinks to URLs. You can specify a selection of URL Lists to search for, and exclude any URLs that are known to be trusted. For more information, refer to URLs and Hyperlinks clause.

• Virus Detection

  The Virus Detection clause searches for viruses in a message using virus types.

  You cannot edit the Virus Detection clause.

• Which Media Types

  The Which Media Types clause looks for selected media types. You can use a Which Media Types clause to look for types of file (for example, documents or images) or file extensions. For more information, refer to Which Media Types clause.

• With a Filename of...

  The Filename clause looks for specific filenames using pre-configured Filename Lists. Filename Lists consist of filename identifiers you might want the Gateway to intercept using this clause.

  Content rules created from a Detect Media Types or Detect Filename template. You can specify whether the rule will trigger if the filenames are detected or if they are not detected.

  To find out more about creating or modifying a list of filenames, see the topic Filename Lists.