Overview
Nevelex Labs provides a McAfee Web Gateway plugin to expose list management capabilities within the McAfee Web Gateway.
Functionality
The plugin provides the following functionality:
- Add entries to a list
- Remove entries from a list
- Send broadcast block/unblock domain events to any plugin configured to listen for the broadcast
Instance Configuration Parameters
Name for the McAfee Web Gateway instance.
A system-wide unique identifier for this plugin instance used to locate the service.
Requires TLS communication between the plugin instance and the McAfee Web Gateway REST API. If enabled, the port number is typically 4712. If disabled, the port number is typically 4711.
IP or host name of the McAfee Web Gateway.
The port number for connecting to the McAfee Web Gateway. Without TLS, the port is typically 4711. With TLS enabled, the port it typically 4712.
The McAfee Web Gateway username with REST API role capabilities enabled.
The password for the McAfee Web Gateway username.
Listen for Domain Block broadcast events. This means the domain and, for Wildcard Expression lists, domain variants are added to the list. The domain variants are:
- domain.tld
- domain.tld/*
- *.domain.tld
- *.domain.tld/*
Listen for Domain Unblock broadcast events. This means the domain and, for Wildcard Expression lists, domain variants are removed from a list. The domain variants are:
- domain.tld
- domain.tld/*
- *.domain.tld
- *.domain.tld/*
Block list which is the target for broadcast domain block/unblock events. If the list doesn’t exist and the Domain Broadcast Block List Type
is String
, the plugin will create it under Lists->Custom Lists->String
. If the list doesn’t exist and Domain Broadcast Block List Type
is Wildcard Expression
, the plugin will create it under Lists->Custom Lists->Wildcard Expression
.
If the Domain Broadcast Block List
needs to be created, this is the type of the list. If not selected, String
is assumed. String
should be selected when the intent is define a rule set using a URL.SmartList
. Wildcard Expression
ensures a number of variations of the domain are added with wildcards.
Listen for URL Block broadcast events. This means the URL is added to the list.
Listen for URL Unblock broadcast events. This means the URL is removed from the list.
Block list which is the target for broadcast URL block/unblock events. If the list doesn’t exist and the URL Broadcast Block List Type
is String
, the plugin will create it under Lists->Custom Lists->String
. If the list doesn’t exist and URL Broadcast Block List Type
is Wildcard Expression
, the plugin will create it under Lists->Custom Lists->Wildcard Expression
.
If the URL Broadcast Block List
needs to be created, this is the type of the list. If not selected, String
is assumed. String
should be selected when the intent is define a rule set using a URL.SmartList
.
Listen for IP Block broadcast events. This means the IP address is added to the list.
Listen for IP Unblock broadcast events. This means the IP address is removed from the list.
Block list to use for broadcast IP block/unblock events. If the list doesn’t exist, the plugin will create it under Lists->Custom Lists->IP
.
A comment template using mustache format notation for defining the comment set for broadcast events. Only {{ sfMwgListEntry }}
is available for substitution within this template.
Flow Nodes
The display name of the node within the flows.
System-wide unique ID of the plugin instance.
The following actions are supported:
- Block (Add to List) Within
- Unblock (Remove from List) Within
- Block (Add to List) Domain
- Block (Add to List) URL
- Block (Add to List) IP
- Unblock (Remove from List) Domain
- Unblock (Remove from List) URL
- Unblock (Remove from List) IP
The McAfee Web Gateway list to add or removed items from. If the list does not exist, it will be created as an IP
, String
, or Wildcard Express
custom list. This field is editable, so any value may be entered into it. This field is seeded with a default set of list names.
URL / Domain List Type
defines the type of list to create if the designated domain or URL list does not exist. Select a String
list type when the intent is to define a rule set using a URL.SmartMatch
rule. If Wildcard Expression
list type is selected, domains are transformed into the following four entries:
- domain.tld
- domain.tld/*
- *.domain.tld
- *.domain.tld/*
The location within the incoming message to search for list elements. Defaults to msg.payload.ioc
.
The location within the incoming message to search for list element. Defaults to msg.payload.ioc.domain
, msg.payload.ioc.ip
, or msg.payload.ioc.url
depending on the selected Action
.
When the Action
is Block (Add to List) Within
or Unblock (Remove from List) Within
, the following behavior is defined for URLs and domains based on the selection.
- URL: Only URLs are processed while domains are ignored
- Domain: Only domains are processed while URLs are ignored
- URL And Domain: Both URLs and domains are processed
When looking at URLs, this setting enables converts a URL to a domain.tld format prior to adding it to a list.
Learn More
Metro Office Park
2950 Metro Drive, Suite 104
Bloomington, MN 55425
Phone: +1 952-500-8921
©Nevelex Labs, LLC. 2018-2024, All Rights Reserved.
EULA