warning message in MWG version 8.2.2

[Georgiancard]

Hi i see this warning message in MWG dashboard: what is the problem exactly i did not find

McAfee Gateway Anti-Malware is disabled due disabled GTI lookups, and the product's security efficacy is reduced. Please review your settings (especially URL filter configuration) and consider enabling GTI lookups or use Gateway Anti-Malware's air-gapped mode available starting in McAfee Web Gateway 7.8.2. Please refer to KB90767 for further details.

[YashT]

Hello @Georgiancard ,

This issues can be Caused by (one of the following):

• The rule set Set URL Filter Internal Settings is missing.
• You have not enabled the Use online GTI web reputation and categorization services if local rating yields no result option in the configured URL filter.
• A policy restriction has caused a part of the transaction (Request, Response, Embedded Cycle) to trigger the GAM without running through Set URL Filter Internal Settings.

Solution

All requests sent to MWG must go through the rule set: Set URL Filter Internal Settings. This process sets an internal flag for GAM to determine what URL Filter setting must be used for internal GAM lookups. These lookups obtain the URL category and reputation for the complete transaction and include the request, response, and embedded object cycle.

You must place this rule set as a top-level rule set in your policy and enable it in all cycles (request, response, embedded object). It is important to place it above all GAM calls and bypass rules that contain the action Stop Cycle.

NOTES:

• The placement of this rule set has no negative effect on MWG performance.
• With the improvements made to GAM in 2017, GTI lookups are now more important. They are required to operate effectively and protect your environment.
• GTI lookups also avoid negative situations such as a high rate of false detections, performance issues or scan failures.
  
  It is from the KB90767

[Georgiancard]

The rule set Set URL Filter Internal Settings is missing, how can i add this where can i download it?

[jacek]

It is in most cases in Common Rules rule set.
If it is missing, you can add it from "Rule Set from Library"

[Georgiancard]

thanks we enabled this rule in the top of the rules and waiting next day, it is appears once every day. In settings "Use online GTI web reputation and categorization" is also enabled

[jacek]

@YashT, I also have exactly the warning in 7.8.2. It appears  about once in 3-4 days (not everyday).

Previously with 7.7.2, there was no such warnings in our env and policy did not changed during upgrade, but I double checked that "Set URL Filter Internal Settings" is enabled for all requests, "Use online GTI web reputation and categorization" is also enabled. All requests/responses reaching GAM, are going through "Set URL Filter Internal Settings".

I'm not sure it will help the Author with 8.2.2, but it does not work for me.

[mkutrieba]

Hello together,

short update with explanation for this.

Background: GAM 2017 performs a check whether URL filter internal settings have been set or not. This is done with the single rule in rule set "Set URL Filter Internal Settings". In there, the event uses an URL filter setting where you can enabled/disable GTI lookups.

Solution: Import/move this rule set on top of policy and enable it in all cycles (request, responses, embedded). So it is ensured, that every single request/response runs into this rule set, settings are properly set and then it does not matter what happens with these requests/responses BUT if something is running into GAM scanning, the check which the GAM performs is successful and this error is not thrown any longer. 

Further, it does not matter whether GTI lookups are enabled or disabled but the configuration itself (rule set, settings) must be there and must be correct. Then the check is successful.

This solution is not depending on any version.

[Georgiancard]

hi, is this correct?

[mkutrieba · Accepted solution]

Hi,

please move the rule set "Set URL Filter Internal Settings" from "Common Rules" to the top of the rule set as the very first rule set in the policy. Further, make sure that this is enabled in request/response/embedded cycle (cannot see this part in the screenshot).

[Georgiancard]

ok we moved it up top of the rule set and will wait next day. thanks