There are a limited number of URLs in the database on-box. ~40 million
There are roughly 11 times more that reside on the GTI cloud. ~400 million
When a URL.Category is looked up, it consults the local database first, then the online database.
At some point in time, that site might have contained adult content and was flagged.
No one has looked at it since and wanted it reverted back.
If you request a site review, they will look at it again and change it.
I'm a little confused as to the wording, but I think you're just asking how come there is a difference between resident and cloud databases?
resident = database downloaded to local web gateway
cloud = database on mcafee servers
The resident database is downloaded in order to prevent the MWG from needing to lookup every URL in the cloud. In addition, the resident database has a maximum size restriction (due to legacy devices, memory restrictions, and trying to keep a lower footprint on the appliance OS, etc...).
The cloud helps with this because it can be whatever size it needs to be, and helps where the resident may not be updated as often. So MWG is configured to check the cloud when the MWG encounters an uncategorized URL (per the resident database).
Does this help?
The example you have given above simply looks like a miscategorization.
Thank you both. That clears it up nicely.
When checking categorizations against https://www.trustedsource.org/en/feedback/url?action=checksingle, I'd always used the option entitlted "McAfee Web Gateway V7/v6 resident" as that was my closest use case from that list (since, you know, I'm running web gateway). As such I never bothered looking at the others and only now understand how the various lists interact. I knew about uncategorized falling through to IP reputation, but I didn't know about a separate cloud database that that site calls "McAfee RealTime Database." Now it's clear, despite everyone's different wording for em.
I submitted a recatogorization on it for teh resident one... so I'm curious what they'll do with hit. If they recat it in resident will they also update realtime? I guess we'll see.
Jon Scholten wrote:
Items in the resident are a subset of what's in the cloud.
So everything that's in the resident is in the cloud, but not the otherway around.
If you selected resident, I think they'll address it in related resident databases as well as the cloud.
FYI, they did indeed follow the path of least astonishment on this. Recategorization request is now closed and the cateogrization is now Blogs/wiki for both "real time" (what others would call cloud) and resident (on-gateway database) lists.
Thanks all for your input.