> ## Documentation Index > Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt > Use this file to discover all available pages before exploring further. # Understanding web access policy, rule containers, and rules > How the WebMarshal Access Policy uses TRACEnet, Google Web Risk, SafeSearch, and rules with user matching, conditions, and actions to control web requests. The WebMarshal Access Policy controls how WebMarshal treats requests for Web resources. The Access Policy includes several types of Rules. The Access Policy also includes the TRACEnet and Safe Search features. ## Understanding TRACEnet The TRACEnet feature is a "zero day" protection framework supported by the LevelBlue Security Labs team. TRACEnet identifies malicious URLs and allows you to block access to these sites. The Security Labs team provides frequent updates to the listed URLs, based on data from a number of sources. This framework gives protection against "blended" threats and new risks. When TRACEnet is enabled, it receives updated URL information from LevelBlue. The TRACEnet digest collator reports summary data about blocked threats to LevelBlue over a secure Web connection. The Security Labs team uses the reported data as part of the threat identification process that feeds back in to TRACEnet updates. TRACEnet initially provides four categories: * Spam sites (URLs offering products or services, that are promoted through spam email) * Phishing sites (URLs hosting fraudulent attempts to harvest personal information) * Anonymous proxies (sites that allow users to bypass security by retransmitting web requests) * Malicious sites (sites hosting malware or exploits) LevelBlue may add new categories to TRACEnet. New categories can be added dynamically during the standard update process. TRACEnet service is included for WebMarshal customers holding current maintenance contracts, as well as with product trials. The maintenance expiration for TRACEnet displays on the TRACEnet page. This information is provided by the TRACEnet update server. To configure TRACEnet, in the left pane of the WebMarshal Console expand **Access Policy** and select **TRACEnet.** ![TRACEnet page with Enabled checkbox, Settings button, library version and maintenance expiry, and Spam Sites, Phishing Sites, Anonymous Proxies, and Malicious Sites categories each enabled](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-tracenet.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=e4a094e113e31d22ad5cefd810a3a76e) WebMarshal Console, TRACEnet window **To enable or disable the feature**, check or clear the box on the main TRACEnet page. To enable or disable the individual categories, check or clear the box for each. You can configure advanced settings for TRACEnet, including User Group and URL exclusions, an end-user "request reclassification" option, and download options. To configure advanced settings, at the top right of the main TRACEnet page click **Settings**. For more information, see Help. To review TRACEnet activity and library updates, see the TRACEnet section of the Real-Time Dashboard. You can also request an immediate check for library updates using the **Update Now** button on the Dashboard. ## Understanding Google Web Risk integration Web Risk is a Google service that lets client applications check URLs against Google's constantly updated lists of unsafe web resources. To configure Web Risk integration, in the left pane of the WebMarshal Console expand **Access Policy** and select **Google Web Risk.** For full information about the options, see Help. ![Google Web Risk page with Enabled checkbox, Settings button, and Unwanted Software, Social Engineering, and Malware categories each set to Block Site or Continue with Warning](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-safebrowsing.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=98369666eff2820f0376a2d9332bd2b5) WebMarshal Console, Google Web Risk window **To enable or disable the feature**, check or clear the box on the main Google Web Risk page. To enable or disable the individual categories, check or clear the box for each. You can also choose to allow users to continue with a warning. > [!NOTE] > > Google Web Risk is only enabled after you enter a Google API Key. To check or enter the key, on the main Google Web Risk page click **Settings**. You can configure advanced settings for Google Web Risk integration, including User Group and URL exclusions. To configure advanced settings, at the top right of the main Google Web Risk page click **Settings**. ## Enforcing SafeSearch WebMarshal allows you to enforce use of the "Strict Safe Search" function that some search engines provide. At this release, WebMarshal Safe Search supports Google, Yahoo!, and Bing safe search, as well as YouTube Safety Mode. This feature adds the "safe search" parameter to each request that a user makes to the supported search engines or sites. > [!NOTE] > > The search filtering provided when WebMarshal Safe Search is enabled depends entirely on the results returned by the specific search engine, and is not based on any further evaluation by WebMarshal. The search engines do not guarantee that they can filter out 100% of the offensive or adult material returned by a search. The content excluded from the search results through WebMarshal is in line with the search engine providers' policy. See the search provider websites for more details. To configure Safe Search, in the left pane of the WebMarshal Console expand **Access Policy** and select **SafeSearch**. * **To enable or disable the feature**, check or clear the box on the main Safe Search page. * You can choose to exclude one or more User Groups from this feature. To configure User Group exclusions, at the top right of the main Safe Search page click **Settings**. For more information, see Help. ## Understanding rules The main feature of WebMarshal Access Policy is the Rules. Each rule is defined with a set of conditions, and a set of actions that WebMarshal takes if a Web request meets the conditions. The Access Policy can also use Rule Containers. A Container allows you to group a set of rules that share common conditions (for instance, user matching or request direction). Rules within a Container only apply when a request meets the conditions defined for the container. Each WebMarshal Rule has three parts: User Matching, Conditions and Actions. * User Matching allows you to specify the server groups where the rule applies, and the users or workstations that the rule applies to. * If the request meets the User Matching criteria, it is evaluated using the Conditions. * If the request meets the Conditions, WebMarshal performs the Actions. For instance, a rule might state: ```text theme={null} When a web request is received for any User (user matching), And where addressed to any URL If the content matches the TextCensor Script Sports Betting (conditions) Classify the Domain as Sports Betting Add the URL Domain to the Category Betting Sites (actions). ``` > [!NOTE] > > When WebMarshal is installed as a new installation, the Configuration Wizard offers the choice to install a basic set of rules. Each rule includes comments as to its possible use. To use these rules, add users to the appropriate user groups and modify the rules to fit your organizational policy. You can also use the default rules as models in creating new rules. ## Understanding rule types WebMarshal rules are divided into five types: Connection Rules, HTTPS Rules, Quota Rules, Standard (Site) Rules, and Content Analysis Rules. Within each type you can create Rules and Rule Containers. > [!NOTE] > > **Rule Containers** allow you to set a single group of conditions for several rules. For instance, you can have one Quota Rule container for rules that apply on weekends, and another Quota Rule container for rules that apply on weekdays. A Rule Container can include any of the conditions that are available for the rule type. ### Connection rules Connection Rules are evaluated when WebMarshal receives a request from a user. Connection Rules allow you to implement policy based control of HTTP connections from many Instant Messaging and Streaming Media applications such as Windows Live Messenger or Real Media, as well as the WebSocket protocol. > [!NOTE] > > For Connection Rules to be effective, you must ensure that other ports used by these applications are blocked at the firewall. For more information, see LevelBlue Knowledge Base article [Q12021](https://support.levelblue.com/kb/article.aspx?id=12021). > > * Before you can use Connection Rules, you must enable this functionality in the WebMarshal Global Settings. For more information, see [Configuring connection rule processing](https://docs.levelblue.com/webmarshal/user-guide/managing-configuration#configuring-connection-rule-processing). ### HTTPS rules HTTPS rules are evaluated when a user connects to a website that uses HTTPS (Secure HTTP). HTTPS Rules allow you to implement policy based on the encryption protocol and the security certificate used. HTTPS Rules also allow you to scan the content of selected HTTPS traffic. HTTPS traffic to be scanned is decrypted, and then re-encrypted for transfer to the destination. > [!NOTE] > > Before you can use HTTPS rules, you must configure the HTTPS functionality. See [Configuring HTTPS content inspection](https://docs.levelblue.com/webmarshal/user-guide/managing-configuration#configuring-https-content-inspection). > > * When HTTPS rules are enabled, content is always secured when transmitted over the network. > * HTTPS traffic that does not match a rule requiring scanning is not decrypted. ### Quota rules Quota rules are evaluated when WebMarshal receives a request for a Web resource from a browser session, and if necessary after the response has been returned from the Web. These rules allow users specific amounts of web browsing time and/or volume for a period such as a day or week. Quota rules can have conditions based on time of day or day of the week, file type, URL category, and the protocol or application. For information about managing Quotas, see [Configuring access using quotas](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#configuring-access-using-quotas). For a full list of conditions and actions, see Help for the Quota Rules window in the WebMarshal Console. ### Standard rules Standard rules are evaluated when WebMarshal receives a request from a browser session. Standard rules allow you to permit or deny access to URL categories by user groups. Standard rules also allow you to match or rewrite the headers of a web request or response. Standard rules can have conditions based on time of day or day of the week, file name, file type, presence of cookies, and the request direction (upload or download). Depending on the outcome of rule evaluation, WebMarshal can permit or deny access to the resource, and optionally require the user to acknowledge a warning. > [!NOTE] > > WebMarshal only grants access by explicit standard rules. The default action is to block access. If your organizational policy is to allow most requests, you should set up a permissive Standard rule that is evaluated last. The WebMarshal default rules include rules that accomplish this. ### Content analysis rules Content Analysis rules are evaluated when WebMarshal receives the content of the Web request. This type of rule allows you to base policy on the actual results of a specific request, including new or dynamically generated files. > [!NOTE] > > * Some Content Analysis rules require WebMarshal to fully scan the response files before returning them to the user. If you configure complex rules and scripts, the user may experience a delay during scanning. To minimize the delay, in most cases a TextCensor rule that blocks a request should also add the URL to a category. WebMarshal can then use a standard rule to block future requests for the URL quickly, using a Standard rule. > * To reduce the delay due to processing, in some cases WebMarshal begins to return a file to the user. A small part of the file is held back from the user until WebMarshal has completely received and processed the file. If the page triggers the rule, the download is aborted. For information about configuring this feature, see [Configuring download options](https://docs.levelblue.com/webmarshal/user-guide/managing-configuration#configuring-download-options). Content Analysis rules can check for many conditions, including: * Request direction (upload or download) * Transfer size * File type * Content type (based on MIME type, such as MPEG) * Text content (TextCensor lexical analysis) * Malware scanning results Content Analysis can also check items unpacked from archive files and OLE documents in many cases. Content Analysis rules can apply a number of actions, including: * Permit or block the request * Display a warning page and require the user to acknowledge * Write a log classification for the file or the request domain * Add the user to a group * Add the request URL to a URL category * Notify the administrator ## Working with access policy To work with rules in the WebMarshal Console, ensure that the menu item Access Policy is expanded. ### Creating a rule or rule container WebMarshal Rules and Rule Containers have many elements in common. The procedure below illustrates the creation of an example rule. The available options are covered in the following sections. 1. In the left pane of the Console, expand **Access Policy**. Select a rule type. 2. If you want to create the rule within a container, double-click the container in the right pane to open it. 3. Click the **New Rule** icon in the taskpad. 4. Click **Next** to continue to the User Matching Conditions page. 5. On the User Matching Conditions page, check the boxes in the top pane to select the conditions you want to include in the rule. The items you select items display in the rule description pane, at the bottom of the page. ![New Standard Rule Wizard User Matching Conditions page with Where the user is a member of UserGroup checked and the rule description pane below](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-um.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=4d88e78999dea0b76179fd109a0bf89c) New Standard Rule Wizard, User Matching Conditions page 6. If you can specify details for a condition, each item that requires details includes a hyperlink. The hyperlink text is red if you must enter a value, or blue if a value is already specified. Click any hyperlink to enter or change the detail information. For more information about the specific expressions, see [User matching conditions](#user-matching-conditions). 7. For instance, if you select *where the user is a member of User Group,* the text **UserGroup** in the rule description is a red link. Click this link to display the Select User Groups window. ![User Matching Condition window](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-um-memberof.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=18202f3a08261c52a7e1579ef9002cf8) User Matching Condition window In this window, you can select an existing user group. You can also create or import a new group. If you create or import a group, it is selected for use when you return to the Select User Groups window. > [!NOTE] > > If your WebMarshal installation uses more than one type of authentication, remember to include all authentication types in Rules. For instance, if WebMarshal uses both Windows and IP authentication, User Matching should include both user names and workstation names as appropriate. 8. Click **Next** to continue to the Rule Conditions page. 9. Select conditions and enter details on this page in the same way as for step 5. See [Rule conditions](#rule-conditions) for details on options for the specific conditions. 10. When you have entered all the details on the Rule Conditions page, click **Next** to continue to the Rule Actions page. 11. Select actions and enter details on this page in the same way as for step 5. The actions that you can select vary depending on the type of rule. See [Rule actions](#rule-actions) for details on options for the specific actions. 12. When you have entered all details on the Rule Actions page, click **Next** to continue to the Rule Completion page. ![Rule Completion page with a rule name, the Turn on this rule checkbox, an optional comment field, and the rule description](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-finish.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=922fcf9bd7448d0a1835fa215c7ff228) New Standard Rule Wizard, Rule Completion page 13. Enter a name for the rule. 14. Optionally enter a comment or description for the rule. 15. Choose whether to enable the rule immediately (default) or not, using the **Turn on this rule** checkbox. 16. Click **Finish** to return to the WebMarshal Console. > [!NOTE] > > The **order of evaluation** of rules is important. WebMarshal bases its action on the first rule triggered. You can adjust the order of evaluation. See [Understanding the order of evaluation](#understanding-the-order-of-evaluation). > > **Changes only take effect when you commit configuration**. To commit configuration, click the Commit Configuration icon on the tool bar. When changes have been made but not reloaded, the icon is red and the item **WebMarshal** at the top of the left pane is followed by `*`. A notice also displays in the status bar. ### Editing rules The following procedure applies to all types of WebMarshal Rules and Rule Containers. To edit a rule or rule container: 1. In the left pane of the console, expand **Access Policy**. 2. Select the Rule type or Rule Container that includes the item you want to edit. 3. Double-click the rule or rule condition in the right pane. The rule is presented in the Rule Wizard–Rule Completion page. 4. Click any hyperlinked item to change it. If you want to make more basic changes to the actions or conditions, click **Back** to view the User Matching, Conditions, or Actions pages. 5. When satisfied, click **OK**. ### Enabling and disabling rules You can enable or disable individual rules or rule containers. Disabled rules (or rules in disabled containers) are not used to evaluate web requests. Disabled rules and containers display with a rule-disabled icon (dimmed, with a red ⊘). ![Power User Policy rule container listing Standard rules, most marked Disabled with the rule-disabled icon, and the selected rule's description below](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rules-disabled.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=bf0f72465d28a2bfe7d2ffb5ddb55cda) WebMarshal Console, Rules window 1. Expand Access Policy, and select a rule type in the left pane. 2. Double-click a particular rule or rule container in the right pane. 3. On the Rule Wizard page, check or uncheck **Turn on this rule**. 4. Click **OK**. You can also enable, disable, or delete Rules and rule containers using a right-click context menu. You can select multiple rules for these actions by using shift-click and control-click. > [!WARNING] > > When you delete a rule container, all the items it contains are also deleted. ## Understanding user matching User Matching allows you to apply policies to specific users (login accounts) or to specific workstations. ### User matching conditions All WebMarshal Rules and Rule Containers can include one or more of the following User Matching conditions. #### Where the user is a member of User Group If this User Matching Condition is selected, the Rule will apply to all members of the User Group(s) listed in the Rule Description pane with this condition (except for members of any of the exception groups, as described below). To add or edit User Groups in this condition: 1. Click a UserGroup link to open the User Matching Condition window. ![User Matching Condition window listing user groups with checkboxes, and Import Group, New IP Address Group, New WebMarshal Group, and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-um-memberof.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=18202f3a08261c52a7e1579ef9002cf8) User Matching Condition window 2. In this window, you can select an existing user group. You can also create or import a new group. If you create or import a group, it is selected for use when you return to the User Matching Condition window. > [!NOTE] > > If your WebMarshal installation allows more than one type of authentication, remember to include all authentication types in Rules. For instance, if both Windows and IP authentication are enabled, User Matching should include both user names and workstation names as appropriate. #### Except where the user is a member of User Group If this User Matching Condition is selected, the Rule will not apply to any member of the User Groups listed in the Rule Description pane with this condition. To add or edit user groups in this condition: 1. Click a UserGroup link to open the User Matching Condition window. 2. Select existing or create new groups as described above. *This condition overrides the previous condition.* For instance, a Rule might start: ```text theme={null} Where the user is a member of Staff, except where the User is a member of Executive ``` > [!NOTE] > > Exception based rules are the key to good resource management. General rules should cover most cases; use exceptions for small groups. You can also use an exception condition alone (for instance, *For any User, except where the User is a member of Executive*). #### Where the server is a member of Server Group If this Condition is selected, the Rule will apply only for requests processed on the WebMarshal Processing Servers contained in the Server Group(s) listed in the Rule Description pane with this condition (except for members of any of the exception groups, as described below). > [!NOTE] > > Server Group conditions allow you to enforce different policies at different locations in a large distributed installation. To add or edit Server Groups in this condition: 1. Click a ServerGroup link to open the Server Condition window. 2. In this window, you can select an existing server group. You can also click **New** to start the New Server Group wizard and create a server group, as described in [Configuring server group properties](https://docs.levelblue.com/webmarshal/user-guide/managing-configuration#configuring-server-group-properties). If you create a new server group, it is selected for use when you return to the Server Matching Condition window. #### Except where the server is a member of Server Group If this Condition is selected, the Rule will *not* apply for requests processed on the WebMarshal Processing Servers contained in the Server Group(s) listed in the Rule Description pane with this condition. ## Understanding rule conditions Each WebMarshal Rule or Rule Container includes one or more conditions. Not all conditions are available for all WebMarshal Rule types. ### Rule conditions The complete list of conditions includes: * When a web request is received for Direction * Where the protocol/application is of type * Except where the protocol/application is of type * Where the URL is a member of Category * Except where the URL is a member of Category * Where the time of day is inside or outside of Schedule * Where the server certificate is invalid * Where the security protocol is * Where the site requests a client certificate during SSL/TLS negotiation * Where SSL/TLS could not be negotiated * Where the content is/is not inspected HTTPS content * Where the request contains cookies * Where the header(s) match * Where the URL domain name is an IP address * Where the transferred data size is size * Where the content matches all/any of TextCensor Script(s) * Where the result of a malware scan is * Where the file type is * Except where the file type is * Where the file is or contains a file of type * Where the parent file type is * Except where the parent file type is * Where the file name matches * Except where the file name matches * Where the parent file name matches * Except where the parent file name matches * Where the download content type is * Except where the download content type is * Where an error occurs while unpacking #### When a web request is received for direction If this Condition is selected, the Rule will apply to all requests of the selected type (upload or download). Downloads include standard web page views and file access. Uploads include form and file posting. Click **Direction** to open the Data Direction window. Select **Downloading** or **Uploading**, and then click OK. #### Where the protocol/application is of type If this condition is selected, the Rule will apply for requests from specific Instant Messaging, Streaming Media, and WebSocket applications. Click **Protocol/Application** to open the Select Application window. 1. Select one or more applications to match by checking the boxes. To view the detailed description of the protocol, hover over an item. ![Rule Condition window listing WebSocket, Instant Messaging, and Streaming Media applications with checkboxes](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/where-the-protocol-application-is.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=defd4f08253bb27f9dc057ba3339a872) Rule Condition window, Where the protocol/application is 2. Click **OK** to return to the parent Wizard. You can specifically exclude applications using the exclusion condition **Except where the URL is a member of Category**. #### Except where the protocol/application is of type If this condition is selected, the Rule will not apply for requests from specific Instant Messaging, Streaming Media, and WebSocket applications listed in the Rule Description pane with this condition. Within a Rule, this condition overrides the condition **Where the protocol/application is of type.** #### Where the URL is a member of category If this Condition is selected, the Rule will apply for requests to all members of the URL Category (or Categories) listed in the Rule Description pane with the condition. > [!NOTE] > > URL matching is not case sensitive. Click **Category** to open the Select URL Categories window. 1. Select one or more URL Categories to match by checking the boxes. To view the detailed description of a category and the number of URLs it includes, select the category name and then click **Properties**. ![Rule Condition window listing URL categories with checkboxes, and New and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-url-memberof.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=a2bd86fe33ff139158a95a9b44f7001e) Rule Condition window, Where the URL is a member of 2. Optionally click **New** to create a new URL Category. 3. Click **OK** to return to the parent Wizard. You can specifically exclude URLs using the exclusion condition **Except where the URL is a member of Category**. #### Except where the URL is a member of category If this Condition is selected, the Rule will not apply for requests to any member of the URL Category (or Categories) listed in the Rule Description pane with this condition. Within a Rule, this condition overrides the condition Where the URL is a member of category. See [Where the URL is a member of category](#where-the-url-is-a-member-of-category) for details on how to select Categories to match. Exception based rules are the key to good resource management. General rules should be created to cover most cases; exceptions should be made for small numbers of sites. For instance, a Rule might apply ```text theme={null} Where the URL is a member of News Sites, except where the URL is a member of Tabloids. ``` You can use an exception condition alone (for instance, `Where addressed to any URL, except where the URL is a member of Tabloids.`) #### Where the time of day is inside or outside of schedule If this Condition is selected, the Rule will apply at specific times depending on the Schedule selected. Click **Schedule** to select a schedule using the Select Schedule window. 1. Select a Schedule to match using the radio buttons. To view or edit the details of a schedule, select the schedule name and then click **Properties**. ![Rule Condition window listing Business Hours and Weekends schedules with radio buttons, and New and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-schedule.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=55c53d0ec12196edf736f5f7d0107352) Rule Condition window, Where the time of day matches 2. Optionally click **New** to create a new Schedule, as described in [Configuring access using schedules](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#configuring-access-using-schedules). 3. Schedule conditions normally match times within the schedule (blue area in the schedule policy element). If you want to match times outside the schedule, click **inside** and select **Inside** or **Outside**. 4. Click **OK** to return to the parent Wizard. #### Where the server certificate is invalid This condition allows you to apply a rule based on the validity conditions of a security certificate used by a HTTPS website. Click the **Invalid** link to open the Invalid Certificate window and select the certificate problems you want to check for. 1. Select one or more problems. If **any** of the problems occurs, the condition is met. WebMarshal can check for the following problems: * **Certificate is not valid for the web site**: The certificate presented is not valid for the website (URL) the user is trying to access. * **Certificate has expired**: The security certificate has expired. * **Certificate is not yet valid**: The start of the certificate validity period has not been reached. Security certificates can have a future start date. * **Certificate is self-signed**: The certificate has not been validated by a root certificate. It is validated only by the remote web server. * **Certificate chain is not trusted**: The certificate cannot be chained back to a trusted root certificate, or WebMarshal does not recognize enough of the certificate chain. * **Certificate breaks certificate validation rules**: The certificate does not conform to the industry standard for security certificates used to authenticate a website (typically due to usage constraints encoded in the certificate). * **Certificate is revoked**: The certificate is marked as revoked by the issuer. * **Certificate revocation check failed**: WebMarshal could not check the certificate revocation status. For more information about possible reasons see Help. > [!NOTE] > > Before you can use the two revocation options you must enable certificate revocation checking. See [Enabling certificate revocation checking](https://docs.levelblue.com/webmarshal/user-guide/managing-configuration#enabling-certificate-revocation-checking). 2. Click **OK** to return to the parent Wizard. #### Where the security protocol is protocol This condition allows you to check for the specific security protocol that was used for a HTTPS connection. The available protocols are distinguished by the difference in their cipher strength. The minimum protocol strength recommended is TLSv1.0. > [!NOTE] > > WebMarshal uses only TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3 by default. SSLv2 connections are never allowed by the WebMarshal Proxy. SSLv3 connections are not allowed by default, but can be allowed. For information about how to change this default, see LevelBlue Knowledge Base article [Q20067](https://support.levelblue.com/kb/article.aspx?id=20067). Click **Protocol** to open a window that allows you to select one or more protocols that connections can use. Select the protocols, and then click **OK** to return to the parent wizard. > [!NOTE] > > The protocol use for a connection is selected automatically from the available protocols. Generally the strongest protocol advertised by the remote web server is selected. You can use this condition if you want to block connections to web servers that do not support strong ciphers. You could also use this condition to create rule-based exceptions for sites that are required by your business but do not support best practice cipher strength. #### Where the site requests a client certificate during SSL/TLS negotiation This condition allows you to take action when the remote web server requires the client browser to supply a security certificate, which will be used in addition to the server certificate. The client certificate uniquely identifies the user and can help to ensure security of a connection. WebMarshal cannot inspect HTTPS content when a page requires a client certificate. Use this condition with a rule action to block access, or to permit access without inspecting content. > [!NOTE] > > WebMarshal can only use the configured rule action if the request for a client certificate comes during the initial HTTPS negotiation. If the client certificate is requested later in the process, WebMarshal will block the request and return a special block page titled Client Security Certificate Required. #### Where SSL/TLS could not be negotiated This condition allows you to take action when the user enters a HTTPS URL, but WebMarshal and the server cannot agree a security protocol. > [!WARNING] > > If WebMarshal and the remote server cannot negotiate a protocol, traffic could be passed through uninspected. By default, this situation should be very rare since WebMarshal first negotiates any protocol and then checks the result to determine if the connection should be allowed. > > Best practice is to **block** all HTTPS connections where SSL/TLS could not be negotiated. #### Where the content is inspected HTTPS content This condition can be used in a Standard or Content Analysis rule to determine if a request has been made from inside an inspected HTTPS connection. You can use this condition to apply different rules to data that WebMarshal has extracted from a HTTPS connection. 1. Click **is** to open a window that allows you to select from the following options: * **Content is from inside an inspected HTTPS connection:** The request was made as a HTTPS connection that WebMarshal is inspecting. * **Content is from a normal HTTP or non-inspected HTTPS connection:** The request was a standard HTTP request, or a HTTPS request that has not been decrypted by WebMarshal. 2. Click **OK** to return to the parent window. #### Where the request contains cookies This Condition allows you to apply Rules to download responses that send HTTP "cookies" as part of the response. To apply this condition, select the box. > [!NOTE] > > WebMarshal does not currently check for request cookies (sent by the client). WebMarshal cannot check for cookies created by client-side action (such as JavaScript). #### Where the URL domain name is an IP address This Condition, available in Standard rules, allows you to check for attempts to browse by IP address including IPv4 and IPv6 addresses. > [!TIP] > > Typically browsing by IP address is an attempt to circumvent the WebMarshal Rules. Most organizations will choose to block browsing by IP address for all users (with a few exceptions if necessary). #### Where the header(s) match This Condition, available in Standard rules, allows you to check the existence and content of HTTP headers. Header matching can apply to request headers (sent by the client), response headers (sent by the server), or both. You can include one or more Header Match conditions in a single rule condition. Click **matches** to open the Header Match Conditions window. ![Header Matching Conditions window with Match all conditions selected and a Server header condition applied to the server response](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-headermatch.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=3215ca8550cda4c2e0f89b2c07b17feb) Header Matching Conditions window To begin choosing headers for matching, click **Add.** On the Add Item window, select the header name and define the action to perform. ![Add Item window with Header Name, Condition, and Search Expression fields, and Apply to client request and Apply to server response checkboxes](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-headermatch.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=2b3e098549d2109ae6daf3903fc9dfab) Add Item window, HTTP header matching options To change or remove the header matching actions, on the Rule Action window select an item and then click **Edit** or **Delete**. For more information, see Help. #### Where the transferred data size is size This Condition allows you to apply Rules based on the total size of a web request (sent or received). To choose file sizes, in the Rule Wizard click **Size** to open the Data Size window. 1. Choose whether to trigger on file transfers greater than or less than a specified size, or between two sizes. 2. Enter the size(s) in KB. ![Rule Condition window set to match any transfer whose size is greater than 1024 KB](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-filesize.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=f929b804c0aec42e6915c338157e9120) Rule Condition window, Where the transferred data size is 3. Click **OK** to accept changes and return to the parent Wizard. Click **Cancel** to revert to the saved information. > [!NOTE] > > WebMarshal only checks the total transfer size for each request (for instance, a HTML file, image, .zip file, or .wav file). WebMarshal does not check the sizes of individual files that could be unpacked from an archive. #### Where the result of a malware scan by scanner is This condition invokes the scanners you select to check for viruses and other malware. > [!NOTE] > > WebMarshal can apply malware scanning to all types of files. You can limit scanning (for instance, you can choose not to scan image files), by using a file type or content type condition in the rule or rule container. > > Some files are generally safe (not known to contain malware payloads). Scanning all files provides added assurance but has a significant impact on performance and user experience. > > The WebMarshal default Access Policy includes two types of Malware scanning rules: > > * The standard scanning rules **exclude** common image types and text from scanning. > * The "Extensive" rules scan all files. These rules are typically 2 to 4 times slower than the standard rules. To select scanners: Click the hyperlink **Scanners** to open the Malware scanner used window. ![Rule Condition window with options for all malware scanners, all scanners of a type, or a specific scanner](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-scannerused.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=f3304e605d1ffb2948f6a59d9ac6f0a1) Rule Condition window, Where the malware scanner used is 1. Choose which scanners to use. You can only select scanners you have configured in WebMarshal. > [!NOTE] > > If you have installed scanner software but you have not yet configured it, you can configure it by clicking **New**. * **All malware scanners:** This condition will check files using all configured scanners. * **A specific scanner:** This condition will check files using a specific scanner. Use the menu to choose from the configured scanners. To view details of a selected scanner, click **Properties**. 2. Click **OK** to return to the parent Wizard. To select scanner results: Click the hyperlink **Scanner result** to open the Result of malware scan window. ![Rule Condition window listing malware scan results with checkboxes, with File contains malicious content checked](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-scannerresult.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=83ea2d0e64f2b8a43812ab1e9e4ec1af) Rule Condition window, Where the result of a malware scan is 1. Check the boxes to select the desired conditions. In general, the more boxes selected, the more restrictive the conditions on downloads or uploads. * **File is clean:** The condition will trigger if the file is reported as clean by all scanners selected within this rule condition. * **File contains malicious content:** The condition will trigger if the file is reported to contain malware by any scanner selected within this rule condition. This is the basic condition. * **Could not scan file - Password protected:** When this box is checked, the condition will trigger if any scanner reports the file as password protected. * **Could not scan file - File is corrupt:** When this box is checked, the condition will trigger if any scanner reports the file as corrupt. * **Scanner signatures out of date:** When this box is checked, the condition will trigger if any scanner reports its signature files are out of date. * **Scanner update failed:** When this box is checked, the condition will trigger if the last update attempt for any scanner was unsuccessful. * **Could not fully unpack or analyze file:** When this box is checked, the condition will trigger if any scanner reports that it could not unpack the file. * **Unexpected scanner error:** When this box is checked, the condition will trigger if any scanner reports an unknown error or the code returned is unknown. 2. Click **OK** to return to the parent Wizard. > [!NOTE] > > Best practice is to block files that are reported as password protected or corrupt (since these cannot be scanned) as well as files containing malware. #### Where the content matches TextCensor script This Condition invokes one or more TextCensor Scripts to check the text content of a web page or other text file. > [!NOTE] > > If a TextCensor Rule applies a "Permit" or "Block" action, all response text files which match the user group and other conditions are fully scanned before being returned to the user. If you have configured complex scripts, scanning can have an impact on perceived performance. To enhance processing speed, in most cases a TextCensor rule that blocks a request should also add the URL to a category. This allows WebMarshal to block future requests for the URL quickly, using a Standard rule. 1. Select one or more Scripts to match by checking the boxes in the Select TextCensor Script window. ![Rule Condition window listing TextCensor scripts with checkboxes, with Gambling checked, and New and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-script.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=a6205b90d07800c0ca335b6c1fc63f45) Rule Condition window, Where the content matches 2. To create a new TextCensor Script, click **New**. For more information see [Identifying web content using TextCensor scripts](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#identifying-web-content-using-textcensor-scripts). 3. To review and edit an existing TextCensor script, select the script name and then click **Properties**. If you have selected more than one TextCensor Script from the list., you can choose whether the content must match all, or any, of the selected scripts. To choose an option: 1. Click **All** to open the Multiple Scripts window. Choose from the following * Match all selected scripts: If you choose this option, the condition will only be true if all of the selected scripts trigger. * Match any of the selected scripts: If you choose this option, the condition will be true if any of the selected scripts trigger. 2. Select an option, and then click **OK** to return to the parent Wizard. #### Where the file type is This Condition allows you to apply Rules to specific file types. File types are recognized by their internal structure, and not by their name or extension. > [!WARNING] > > Although this condition is available in both Standard and Content Analysis rules, LevelBlue recommends you use it only in Content Analysis rules. Standard Rules are often evaluated when only part of the data is available, and for many types this makes determining the type of the file unreliable. Content Analysis rules are always evaluated once the entire file has been downloaded and the file type has been correctly determined. For more information, see LevelBlue Knowledge Base article [Q12839](https://support.levelblue.com/kb/article.aspx?id=12839). * In Standard rules, this Condition only checks the top level file that was directly requested. * In Standard rules applied to uploads, this condition checks the type of files directly uploaded (attached to the upload form). * In Content Analysis rules, this Condition checks the top level file and each file unpacked from archive files. * For more file type matching options, see the Conditions *Where the file is or contains a file of type* and *Where the parent file type is.* > [!NOTE] > > You can match files in two other ways: > > * The Condition Where the file name is allows for file matching by name or extension. > * The condition Where the content type is allows for file matching by the type declared in the web request headers. To choose file types: 1. Within the Rule Wizard click Type to open the **Select File Types** window. 2. Expand any category to see the particular types available. 3. Choose the categories or specific types of files to match. ![Rule Condition window with a tree of file type categories to check, and a lower pane of types that cannot be detected in Standard rules](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-filetype.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=807c135f535519e42993cf02328051e7) Rule Condition window, Where the file type is > [!NOTE] > > Some types cannot be checked by Standard rules. The **Select File Types** window for Standard rules shows these types in the lower pane. You can check for these types in Quota or Content Analysis rules. 4. Click **OK** to accept changes and return to the parent Wizard. Click **Cancel** to revert to the saved information. #### Except where the file type is This Condition allows you to apply Rules to all files that are not of specific file types. *Before using this condition in Standard Rules*, see the note to [Where the file type is](#where-the-file-type-is). * In Standard rules, this Condition only checks the top level file that was directly requested. * In Standard rules applied to uploads, this condition checks the type of files directly uploaded (attached to the upload form). * In Content Analysis rules, this Condition checks the top level file and each file unpacked from archive files. * For more file type matching options, see the Conditions Condition *Where the file is or contains a file of type* and *Where the parent file type is.* To choose file types to exclude, within the Rule Wizard click Type to open the Select File Types window. See the condition **Where the file type is** for details on how to select types. #### Where the file is or contains a file of type This Condition allows you to create Content Analysis Rules that check a condition for a file that was requested, or all files that are contained within it (if it is a document or archive that WebMarshal can unpack). For instance, you can apply a rule to document files that contain images. For other options, see the condition *Where the parent file type is.* To choose file types to match, within the Rule Wizard click Type to open the Select File Types window. See the condition **Where the file type is** for details on how to select types. You can choose to include or exclude the originally requested file from matching. To choose an option: 1. Click **is or contains** to open the Trigger window. Choose from the following * *The transferred file or any unpacked file:* If you choose this option, the condition will consider the type of the originally requested file, and any files unpacked from it. * *Any unpacked file:* If you choose this option, the condition will ONLY consider the type of unpacked files, and will not consider the type of the originally requested file. 2. Select an option, and then click **OK** to return to the parent Wizard. > [!TIP] > > For example, if you want to make a rule that applies to all image files, including image files within documents or archives, select The transferred file or any unpacked file. If you want to make a rule that applies to image files within documents or archives, but NOT directly requested images, select Any unpacked file. > > * If you combine this condition with other conditions, such as a file name condition, the other conditions are evaluated on the main file and NOT on contained files. #### Where the parent file type is This Condition allows you to create Content Analysis Rules that apply to a file that was unpacked from an archive or other unpackable type, depending on the type of the parent file. > [!NOTE] > > For other file type conditions, see ***Where the file is or contains a file of type, Where the file type is, and Except where the file type is.*** To choose file types to match, within the Rule Wizard click Type to open the Select File Types window. See the condition **Where the file type is** for details on how to select types. You can choose to perform matching on the originally requested file, all unpacked files, or only the immediate parent container. > [!TIP] > > You can use this condition in combination with other conditions that apply to the unpacked file. For instance, you can apply a rule where the parent file type is ZIP and the file type is DOC. > > If you combine this condition with other conditions, such as a file name condition, the other conditions are evaluated on the child file and NOT on any parent files. To choose an option: 1. Click **the immediate** to open the Checks window. Choose from the following * *The immediate parent file:* If you choose this option, the condition will consider the type of the file that explicitly contains the unpacked file. * *The top-level parent file:* If you choose this option, the condition will consider the type of the originally requested file (that contains the unpacked file, perhaps within other archives). * *Any parent file:* If you choose this option, the condition will consider the type of each file in the set of archives. 2. Select an option, and then click **OK** to return to the parent Wizard. > [!TIP] > > Suppose you click a link to `archive1.zip`. `archive1.zip` contains `archive2.cab`, and `archive2.cab` contains `data.txt` > > `archive1.zip>>archive2.cab>>data.txt` > > * `archive1.zip` is the top level parent. > * `archive1.zip` is the immediate parent of `archive2.cab`. > > Both `archive1.zip` and `archive2.cab` are the any level parents of `data.txt`. #### Except where the parent file type is This Condition allows you to apply Rules to a file that was unpacked from an archive, if the parent files in the archive are **not** of specific file types. To choose file types to match, within the Rule Wizard click Type to open the Select File Types window. See the condition **Where the file type is** for details on how to select types. You can choose to perform matching on the originally requested file, all unpacked files, or only the immediate parent container. To choose a matching option, click **the immediate** to open the Checks window. See the condition [Where the parent file type is](#where-the-parent-file-type-is) for details of the options on this window. #### Where the file name matches This Condition allows you to apply Rules to files with specific names or extensions. This condition is useful to allow specific files, or to block text files that WebMarshal cannot recognize by their structure or content-type header. > [!NOTE] > > You can match files in two other ways: > > * The condition *Where the content type is* allows for file matching by the type declared in the web request headers. > * The condition *Where the file type is* allows for file matching by internal structure of files. To choose file types, within the Rule Wizard click **Name** to open the Enter File Names window. The `*` wildcard is supported (`*` matches any number of characters; for instance, `*.exe` matches any exe file). ![Rule Condition window listing file name patterns such as \*.com and \*.msi, with New, Edit, and Delete buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-filename.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=726bf21209bcf00dc3e3df16f7f1c18c) Rule Condition window, Where the file name matches 1. To add a name to the list, click **Add**, and then enter the desired name or wildcard string to match partial names. Press Enter or click away from the name when done. 2. To edit an existing name, select it and then click **Edit**. 3. To delete an existing name, select it and then click **Delete**. 4. Click **OK** to accept changes and return to the parent Wizard. Click **Cancel** to revert to the saved information. #### Except where the file name matches This Condition allows you to apply Rules to all files that are not specific file names. To choose file names to exclude within the Rule Wizard click **Name** to open the Except where the file name matches window. The `*` wildcard is supported (`*` matches any number of characters; for instance, `*.exe` matches any exe file). 1. To add a name to the list, click **Add**, and then enter the desired name or wildcard string to match partial names. Press Enter or click away from the name when done. 2. To edit an existing name, select it and then click **Edit**. 3. To delete an existing name, select it and then click **Delete**. Click **OK** to accept changes and return to the parent Wizard. Click **Cancel** to revert to the saved information. #### Where the parent file name matches This Condition allows you to apply Rules to a file that was unpacked from an archive or other unpackable type, depending on the name of the parent file. > [!NOTE] > > For other file type conditions, see *Where the file is or contains a file of type, Where the file type is,* and *Except where the file type is*. To choose file names to match, within the Rule Wizard click **Name** to open the Select File Names window. See the condition [Where the file name matches](#where-the-file-name-matches) for details of this window. You can choose to perform matching on the originally requested file, all unpacked files, or only the immediate parent container. To choose an option: 1. Click **the immediate** to open the Checks window. Choose from the following * *The immediate parent file:* If you choose this option, the condition will consider the name of the file that explicitly contains the unpacked file. * *The top-level parent file:* If you choose this option, the condition will consider the name of the originally requested file (that contains the unpacked file, perhaps within other archives). * *Any parent file:* If you choose this option, the condition will consider the name of each file in the set of archives. 2. Select an option, and then click **OK** to return to the parent Wizard. Example: Suppose you click a link to `archive1.zip`. `archive1.zip` contains `archive2.cab`, and `archive2.cab` contains `data.txt` `archive1.zip>>archive2.cab>>data.txt` * `archive1.zip` is the top level parent. * `archive1.zip` is the immediate parent of `archive2.cab`. Both `archive1.zip` and `archive2.cab` are the any level parents of `data.txt`. #### Except where the parent file name matches This Condition allows you to apply Rules to a file that was unpacked from an archive, if the parent files in the archive **do not** match specific names or extensions. To choose file names to match, within the Rule Wizard click **Name** to open the File Names window. See the condition **Where the file name matches** for details of this window. You can choose to perform matching on the originally requested file, all unpacked files, or only the immediate parent container. To choose a matching option, click **the immediate** to open the Checks window. See the condition [Where the parent file name matches](#where-the-parent-file-name-matches) for details of the options on this window. #### Where the download content type is This Condition allows you to apply Rules to specific content types. Content types are recognized by the header information of the web request. Content type information is only available for downloads (not uploads or postings). The web browser uses the content type information to determine how to display the content, or what helper application to invoke. For instance, a PDF document with content type `application/pdf` usually opens in a PDF plug-in or reader. > [!NOTE] > > You can match files in two other ways: > > * The Condition *Where the file name is* allows for file matching by name or extension. > * The condition *Where the file type is* allows for file matching by the internal structure of the file. To choose content types, within the Rule Wizard click **Type** to open the **Select Content Types** window. ![Rule Condition window with a tree of MIME content types, the image group expanded and checked, and Add, Edit, and Delete buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-contenttype.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=46eafb6d1c3919887d31ef6ca7891285) Rule Condition window, Where the MIME content type is 1. Expand any category to see the particular types available. 2. Choose the categories or specific types of files to match. 3. To match a type not in the list, click **Add**. Enter the new type and optional subtype (for instance, `application/x-my-application`) and then click **OK**. The new type is permanently added to the list of types you can select. Click **OK** to accept changes and return to the parent Wizard. Click Cancel to revert to the saved information. #### Except where the download content type is This Condition allows you to apply Rules to all files that are not of specific content types. Content type information is only available for downloads (not uploads or postings). To choose content types to exclude, within the Rule Wizard click **Type** to open the Select Content Types window. See the condition *Where the content type is* for details on how to select types. #### Where an error occurs while unpacking This Condition allows you to check for archive and document files that WebMarshal cannot unpack. You may want to block files that cannot be unpacked, or notify the administrator. To apply this condition, select the box. ## Understanding rule actions Each WebMarshal Rule includes one or more actions. Not all actions are available for all WebMarshal Rule types. ### Rule actions The complete list of actions includes: * Permit Access * Permit Access after displaying Warning Page * Permit access and inspect content * Permit access and do not inspect content * Block the connection and return a 503 service unavailable return code. * Block Access and display blocked page * Display Warning page once per period and continue processing rules * Strip cookies from this site * Rewrite headers * Classify the domain as classification * Classify the file as classification * Add the User to User Group * Add the URL to a Category * Send a notification to the administrator * Exclude the request from reporting (do not log browsing) * Apply Quota to the user * Stop processing quota rules. * Skip any remaining rules in this container #### Permit access The web page, download, or upload is delivered. #### Permit access after displaying warning page WebMarshal displays a Notification Page in the user's browser. The page asks the user to accept a note or warning. If the user accepts, the original web page, download, or upload will be delivered. Click **Warning Page** to open the Select Web Page window. 1. Select a web page to display from the list 2. Click **OK** to return to the parent Wizard. You can create custom notification pages. See [Notifying users with notification pages](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#notifying-users-with-notification-pages). #### Permit access and inspect content This action is available in Connection rules and HTTPS rules. When this action applies, WebMarshal continues processing the web page, download, or upload. Quota, Standard, and Content Analysis rules are evaluated. > [!TIP] > > Use of this action in Connection rules is intended to support inspection of WebSocket content. #### Permit access and do not inspect content This action is available in Connection rules and HTTPS rules. When this action applies, WebMarshal delivers the web page, download, or upload. Quota, Standard and Content Analysis rules are not applied. #### Block access and display blocked page The web page, download, or upload is not delivered. A WebMarshal Notification Page is shown instead. Click **Blocked Page** to open the Select Web Page window. ![Rule Action window listing blocked notification pages with radio buttons, with Blocked selected](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-display2.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=ef452f3c326a1c4e7c1aac8eff7fd715) Rule Action window, Block access and display block page 1. Select a web page to display from the list 2. Click **OK** to return to the parent Wizard. For rules with a malware scanning action, you can choose a second notification page used for aborted downloads. This page only displays if WebMarshal begins to return the download and then stops it due to a rule condition. The "aborted" page is shown the next time the user makes a web request. **To choose the page that will be shown,** in the rule description (lower pane) click **File Aborted Page** and select a web page to show for aborted downloads, using the Select Web Page window as above. #### Block the connection and return a 503 service unavailable return code When this action is selected, WebMarshal will return a 503 Service Unavailable HTTP response, and the web request will be terminated. This action is available in Connection Rules. Typically it would be used if you do not want to allow an Instant Messaging, Streaming Media, or WebSocket application to connect through WebMarshal. #### Display warning page once per period and continue processing rules If this rule has not been triggered for this user during the time configured, a WebMarshal Notification Page is displayed in the user's browser. Click **Warning Page** to open the Select Web Page window. 1. Select a web page to display from the list. ![Rule Action window listing warning notification pages with radio buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-display.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=7d3f19185be7d3f44ab8c4ef6ebc18b0) Rule Action window, Display warning page once 2. Select the period during which this Rule action will not display the page again. Available periods include the current browsing session, day, week, or month. 3. Click **OK** to return to the parent Wizard. The user will be asked to accept a note or warning. If the user accepts, the original web page, download, or upload will be delivered to the user. After the user accepts, this action will not display this warning page again for the period selected. #### Strip cookies from this site HTTP cookies returned with the response are removed. > [!NOTE] > > This action is only effective for responses (setting of cookies by server-side action). WebMarshal does not currently block cookies sent with a request. WebMarshal cannot block cookies set on the client by JavaScript or other client side action. #### Rewrite headers One or more HTTP headers are added, deleted, replaced, or modified using Regular Expressions. Header rewriting can apply to request headers (sent by the client), response headers (sent by the server), or both. > [!NOTE] > > * Header rewriting is not available for HTTPS CONNECT. > * Header rewriting is not available for response headers in the Websocket protocol. > * Some rule conditions do not affect request header rewriting, because the required information is not available at the time this action is applied. See Help for details. Click **headers** to open the Rewrite Headers window. ![Rule Action window listing header rewrite actions: add or overwrite, delete, and modify existing header, with their direction](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-headerrewrite.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=95bdde4edbcdb9fd1fe60800b7c8e03a) Rule Action window, Rewrite HTTP header fields To begin choosing headers for rewriting, click **Add.** On the Add Item window, select the header name and define the action to perform. ![Add Item window with Header Name, Action, Search Expression, and New Value fields, and Apply to client request and Apply to server response checkboxes](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/editheader.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=afd038011b9fd92921b6ac6218e7142f) Add Item window, HTTP rewriting options To change or remove the header rewriting actions, on the Rule Action window select an item and then click **Edit** or **Delete**. For more information, see Help. #### Classify the domain as classification A Domain Classification is logged in the WebMarshal database (if database logging is enabled). This record shows that the user browsed to a URL which met the Rule conditions. For instance the URL could be in a specific category, or it could be a page with content matching a TextCensor script. Select one or more Domain classifications for this request by checking the boxes in the Select Logging Classification window. ![Rule Action window listing logging classifications with checkboxes, and New and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-classifydomain.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=fc802c8305fbcc144a6d37259c775e7a) Rule Action window, Classify the domain as To create a new classification, click **New**. To review and edit an existing classification, click **Properties**. For more information about adding and editing classifications, see [Logging activity with classifications](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#logging-activity-with-classifications). #### Classify the file as classification A File Classification is logged in the WebMarshal database (if database logging is enabled). This record shows that the user uploaded or downloaded a file which met the Rule conditions. For instance the file could be large or could contain a virus. A file classification applies to a specific upload or download request. Select one or more File Classifications for this request by checking the boxes in the Select Logging Classification window. To create a new classification, click **New**. To review and edit an existing classification, click **Properties**. For more information about adding and editing classifications, see [Logging activity with classifications](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#logging-activity-with-classifications). #### Add the user to a user group The user who triggered a Rule is added into one or more WebMarshal Groups. Select an existing WebMarshal Group or new WebMarshal Group using the Select User Groups window. > [!NOTE] > > You can use this action to place users who attempt to access banned sites into a "watch" group. To create a new group, click **New**. To review and edit an existing group, click **Properties**. See [User management](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#user-management) for more information on User Groups. #### Add the URL to a category The URL domain or path of a request is added to a WebMarshal URL category. For instance, if a URL triggered an offensive language TextCensor script, you may want to add the URL to a permanent block list. 1. Click **Category** to open the Select URL Categories window. 2. Choose one or more categories into which this site should be placed by checking the boxes. ![Rule Action window listing URL categories with checkboxes, and New and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-addurltocategory.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=af9d9efb056172e52b5f22176b85a888) Rule Action window, Add URL to category 3. To create a new category, click **New**. To review and edit an existing category, click **Properties**. See [Understanding URL categories](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#understanding-url-categories) for more information on URL categories. 4. Click **URL** to choose whether to add the entire domain, or only the subdomain (path) to the category. ![Rule Action window with options to insert only the URL domain name or the full URL path](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-addurlorpath.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=ffeb8b5be05d1281114cb0e3a1f519cb) Rule Action window, Add URL to category options > [!NOTE] > > You cannot add filename or query string parts automatically. You can add URLs containing these parts manually. See [Adding URLs to a URL category](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#adding-urls-to-a-url-category). #### Send a notification to the administrator A notification email is sent to the administrator email address as configured on the Email Notifications page of Global Settings. > [!NOTE] > > You should be selective in applying this action. If you apply it for content block actions, the administrator will receive a large number of email messages. #### Exclude the request from reporting Any request that matches the rule conditions is completely exempted from logging (including aggregate browsing time and bandwidth records). For instance, you can use this action: * With a User Matching condition to allow unmonitored Web access for the corporate executive group. * With a URL Category condition to allow unmonitored access for all users to a company extranet site. > [!NOTE] > > A typical site visit includes requests for many files of many different types. Therefore, if you use this action with content analysis or file type rule conditions, it is likely that traces of user activity will be logged. Also, where HTTPS content is not processed by Content Analysis rules an exclusion might not apply. > > **To completely exclude a site visit from logging,** LevelBlue recommends you use this action in a Standard rule with User Matching or URL conditions. > > This action functions differently from the "exclude the site from reporting" action in earlier versions of WebMarshal. #### Apply quota to user A time or volume browsing quota is applied to the user. Select one or more quotas from the Apply Quotas to User window. ![Rule Action window listing time and volume quotas with checkboxes, and New and Properties buttons](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-rule-quota.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=e785a5b557243e53b0bfb2d310324cae) Rule Action window, Apply quotas to the user To create a new quota, in the window click **New** to start the Quota Wizard. To review and edit an existing quota, click **Properties**. For more information on Quotas and the New Quota Wizard, see [Configuring access using quotas](https://docs.levelblue.com/webmarshal/user-guide/policy-elements#configuring-access-using-quotas). #### Stop processing quota rules Any Quota rules that would be evaluated after this rule are not evaluated. The intended user of this action is to avoid charging a browsing action against more than one quota. #### Skip any remaining rules in this container Any additional rules in the container (or in sub-containers) are not evaluated. This action allows conditional checking of groups of rules. ## Understanding the order of evaluation WebMarshal evaluates Connection Rules first, then HTTPS Rules, Quota Rules, Standard Rules, and finally Content Analysis Rules. Within each type, rules are evaluated in a defined order, which you can configure. The order of evaluation can affect the outcome, because WebMarshal bases its action on the first rule triggered. For instance, the default WebMarshal rules block the virus scanner test file `eicar.com` using the rule *Block Dangerous File Extensions.* Since this rule is applied before the malware scanning rules, `eicar.com` is not reported as containing malware. Rules are evaluated in "top down" order as presented in the console display. To change the order of evaluation of rules: 1. Ensure that Rules is expanded. 2. Select a rule type in the left pane. 3. Select a particular rule or rule container in the right pane. 4. Move the item up or down in the evaluation order using the up and down arrow icons in the tool bar. 5. Commit configuration to apply the changes. ## Testing access policy Testing rules involves entering various combinations of User, URL, and File Type or text, and viewing the results. Because the results of rule evaluation are dependent on the order of evaluation, **all applicable rules are evaluated each time a test is performed**. To test rules: 1. In the WebMarshal Console, click the **Test Policy** icon in the tool bar to open the **Test Access Policy** window. > [!NOTE] > > For a more complete description of all test options and results, see Help for this window. Select the test to perform using the tabs. Tests include: * **Browse Site** (Checks the protocol and URL) * **Scan Page Content** (Includes the Browse Site test as well as TextCensor) * **Simulate File** (Includes the Browse Site test as well as file type and content type) * **Test File** (Includes all rules) ![Test Access Policy window on the Browse Site tab with URL, user account, date and time, and protocol fields, and the Detailed Trace tab showing rule evaluation results](https://mintcdn.com/levelblue-5324744e/3HtxpZkxKdsv90As/images/webmarshal/console-testrules.png?fit=max\&auto=format\&n=3HtxpZkxKdsv90As\&q=85\&s=153f6acc0255b72ed2abac7cb903dc5d) Test Access Policy window 2. Enter the URL and the user account you want to use for the test. 3. Enter a date and time you want to use for schedule dependent rules. 4. Choose whether to test download or upload processing. 5. For the Scan Page Content tab, which applies TextCensor scripts to text and HTML documents, enter text in the box. You can enter text by typing directly, by cut-and-paste, or from a web page you are viewing in Internet Explorer (by clicking **Grab**). 6. For the Simulate File tab, you can select a number of features to simulate including the file type, MIME content type, file size, and presence of malware and cookies. 7. For the Test File tab, you can enter the path to a local file you want to use for the test. 8. Click **Advanced** for additional testing options. 9. Click **Test** to begin rule testing. The result of the evaluation is displayed in the Test Results pane. 10. Standard rules are evaluated first. If the result of Standard rule evaluation is "permit with warning page", click **Accept Result and Reprocess Rules** (at bottom of the results) to proceed to the evaluation of Content rules. If the result of Standard rule evaluation is "deny" then Content rules are not tested. 11. If an Alternate Upstream Proxy would be used for the URL, this information is shown following the rule results. 12. Quota Rules that would be applied and Classifications that would be logged are indicated at the bottom of the results pane. 13. To view details of the rule evaluation (such as the TextCensor script results), select the Detailed Trace tab and expand the evaluation tree.