I've marked this as a question, but I've been informed that what's needed comes down to a feature request. But, of which product?
I got to tinkering after trying to make sense of this discussion:
First, I needed to prove a few things to myself. I grabbed a packet trace of a block from an nDLP ICAP server from the proxy (one for which I was triggering the block [very useful: HTTP Post | DLP Test]). I could see the "HTTP/1.1 403 Forbidden\r\n", along with the block page coming from the ICAP server—which is the content that was displayed in my browser (by way of MWG).
I then altered the rule to block on the ICAP.ReqMod.Satisfaction, and that did result in a proxy block page—instead of the ReqMod response.
With a bit more tinkering, I cobbled together a combination of the coaching rule sets and the DLP via ICAP rulesets. And, I was able to get a coaching page to display. However when I tried to click through, I got the block page from the ICAP server.
With a bit more tinkering, I was able to get coaching to work—but I do not like what it took to make it work. Guess why? Because the DLP ICAP server doesn't get to log the the results of the content server—because the DLP ICAP server never gets to look at that content.
Oh, I suppose I could rig logging for this, but that would result in a split solution for those who review the DLP incidents, and I know that's never going to fly.
What would be better is if either, the ICAP product had coaching or there was a variation of ICAP.ReqMod.Satisfaction that ignored the ICAP server's modified response. I don't think the latter is a great option, but it's better than what I've created so far. The best would be an ICAP server with a coaching option, which would allow it to log when it prompts for coaching and when it doesn't (if anyone thinks that makes any difference, and some might). I suppose one might wonder what it would look like if the ICAP protocol had features to facilitate coaching (AFAIK).
Am I missing anything here? Any other thoughts on the subject?
Message was edited by: John Aldridge (added description of coaching rules)