0% found this document useful (0 votes)

189 views121 pages

Anitha

The document details the log of a proxy transaction, including various policy checks and matches. It begins by setting transaction variables and proceeds to evaluate the request against many policy conditions, with some matches found. It ultimately allows the request and assigns category labels before concluding with timing details.

Uploaded by

Annibal

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as TXT, PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

189 views121 pages

Anitha

Uploaded by

Annibal

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as TXT, PDF, TXT or read online on Scribd

You are on page 1/ 121

start transaction -------------------

transaction ID=9478241 type=http.proxy

<Proxy@req-url> [builtin-prolog:372]
MATCH: variable.bc_notify1(empty1) variable.bc_notify2(empty2)

<Cache@req-url "suppress DRTR for HTML Notification internal URLs"> [vpm-

cpl:3477]
miss: condition=__is_notify_internal

<Proxy@req-url "set notify variables"> [vpm-cpl:3962]

[Rule]
miss: url.regex="(.*)/notify-SplashStreaming\?([^;]+);(.*)"
miss: url.regex="(.*)/accepted-SplashStreaming\?([^;]+);(.*)"
miss: url.regex="(.*)/verify-SplashStreaming\?([^;]+);(.*)"

<Proxy>
miss: client.address=10.110.46.73
miss: condition=__CondList1Combinacion_NOAUTH
MATCH: authenticate(ad) authenticate.force(no) authenticate.mode(proxy-ip)

<Proxy>
miss: condition=__CondList1CombinedDestinationBloque_URL
miss: condition=__CondList1Combinacion_Lista_Blaca_Windows_Update
MATCH: ALLOW condition=Combinacion_Lista_Blanca

<Proxy>
miss: client.address=CombinedEquiposEMC_Automacion
miss: client.address=CombinedEquiposEMC_Automacion
miss: client.address=combinacion_TERAREXHCAS
miss: client.address="CombinedSource_DGI Uruguay"
miss: condition=__CondList1ReglaFullInternetAccess_AMS
miss: condition=__CondList1Ternium
miss: client.address=TKCSA_PORTO
miss: condition=__CondList1CombinacionWhatsapp_y_WSUS
miss: url.domain=//services.isee.hp.com/
miss: condition=WebApplication_Blacklist
miss: condition=Combinacion_bloque_Windows_Update
miss: request.application.name=Dropbox
miss: category=Lista_Negra_NormalUser
miss: condition=__CondList1CombinedDestinationBloque_URL
miss: condition=CombinacionReproductoresMedia
miss: condition=__CondList1CombinedSourceBloomberg
miss: condition=__CondList1CombinedSourceBloomberg

<Proxy>
miss: condition=__PROTO_3
miss: condition=__PROTO_3
miss: url.port=22
miss: url.port=22

<Proxy>
miss: condition=__CondList1CombinedSourceBloomberg
miss: client.address=Ternium_FTP

<ssl>
MATCH: server.certificate.validate(no)
<Proxy>
miss: client.address=10.110.50.184
MATCH: client.address=10.110.99.72 trace.request(yes)
trace.destination(Annitha)

<Cache>
miss: condition=__CondList1Sitios_SIN_Cache
miss: url.host=r.sascdn.com

<Proxy>
miss: source.port=8194
miss: source.port=8195
miss: source.port=8196
miss: source.port=8197
miss: source.port=8198

<Proxy>
miss: condition=skype

<Proxy>
miss: request.header.If-None-Match="."

<Proxy>
miss: condition=Tunnel_Exception_urld

<Proxy>
MATCH: policy.BC_SafeSearch_Ask_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Google_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_YouTube_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Lycos_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_MSN_Live_Bing_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Yahoo_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_DuckDuckGo_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Vimeo_Rules

miss: <Proxy> realm=iwa_direct

<Cache>
miss: url.domain=//windowsupdate.com/
miss: url.domain=//c.microsoft.com/
miss: url.domain=//update.microsoft.com/
miss: url.domain=//windowsupdate.microsoft.com/
miss: url.domain=//download.windowsupdate.com/

<Proxy>
miss: condition=SSL_Disabled_Domains

<Proxy "handle HTML Notification internal requests">

miss: [Rule] variable.bc_notify1=variable.bc_notify2
[Rule]
MATCH: action.__delete_notify_cookies(yes)

<Proxy>
miss: http.method=POST
miss: http.method=POST
miss: http.method=PUT

<Proxy>
miss: url.port=21
miss: url.port=21

<Proxy>
miss: condition=IWA_SILENT_USERS

<Proxy>
miss: request.header.User-Agent="webex utiltp"
miss: request.header.User-Agent="Microsoft-CryptoAPI"
miss: request.header.User-Agent="MSUpdate"
miss: request.header.User-Agent="AVUpdate"
miss: request.header.User-Agent="ESS Update"
miss: request.header.User-Agent="iTunes"
miss: request.header.User-Agent="Stocks"
miss: request.header.User-Agent="CFNetwork"
miss: request.header.User-Agent="Shockwave Flash"
miss: request.header.User-Agent="Windows-Media-Player"
miss: request.header.User-Agent="NSPlayer"
miss: request.header.User-Agent="Windows-Media-Player"
miss: request.header.User-Agent="flash"
miss: request.header.User-Agent="Office"
miss: request.header.User-Agent="TMUFE"
miss: request.header.User-Agent="62691CB3BF62DAF233FB2C02782E7BD2"

<Proxy>
miss: condition=Office365IPs
MATCH: condition=Office365URLs detect_protocol(none)

<Proxy>
miss: condition=Office365IPs
MATCH: condition=Office365URLs detect_protocol.ssl(no)

<Cache>
miss: condition=Office365IPs
MATCH: condition=Office365URLs request.icap_service(no)
response.icap_service(no)

<Proxy>
miss: url.domain=//facebook.com/
miss: url.domain=//sped.fazenda.gov.br/
miss: url.domain=//ternium.com.ar/Autodiscover/Autodiscover.xml
miss: url.domain=//ternium.com.mx/Autodiscover/Autodiscover.xml
miss: url.domain=//ternium.com.co/Autodiscover/Autodiscover.xml
miss: url.domain=//ternium.com.br/Autodiscover/Autodiscover.xml
miss: url.domain=//ternium.com.uy/Autodiscover/Autodiscover.xml
miss: url.domain=//ternium.com/Autodiscover/Autodiscover.xml
miss: url.domain=//tessa.com.uy/Autodiscover/Autodiscover.xml

Called policy definition: BC_SafeSearch_Lycos_Rules

miss: <Proxy BC_SafeSearch_Lycos> url.domain=//lycos.com/

Called policy definition: BC_SafeSearch_Yahoo_Rules

miss: <Proxy BC_SafeSearch_Yahoo_cookies> condition=BC_SafeSearch_Yahoo_Domains
miss: <Proxy BC_SafeSearch_Yahoo_query> condition=BC_SafeSearch_Yahoo_Domains

Called policy definition: BC_SafeSearch_DuckDuckGo_Rules

miss: <Proxy BC_SafeSearch_DuckDuckGo_query> url.domain=//duckduckgo.com/

Called policy definition: BC_SafeSearch_Ask_Rules

miss: <Proxy BC_SafeSearch_Ask_query> condition=BC_SafeSearch_Ask_Domains

Called policy definition: BC_SafeSearch_YouTube_Rules

miss: <Proxy BC_SafeSearch_YouTube_cookies> url.domain=//youtube.com/

Called policy definition: BC_SafeSearch_Vimeo_Rules

miss: <Proxy BC_SafeSearch_Vimeo_cookies> url.domain=//vimeo.com/

Called policy definition: BC_SafeSearch_Google_Rules

miss: <Proxy BC_SafeSearch_Google_query> condition=BC_SafeSearch_Google_Domains
miss: <Proxy BC_SafeSearch_Google_SetPref> condition=BC_SafeSearch_Google_Domains

Called policy definition: BC_SafeSearch_MSN_Live_Bing_Rules

miss: <Proxy BC_SafeSearch_MSN_Live_Bing_cookies>
condition=BC_SafeSearch_MSN_Live_Bing_Domains
miss: <Proxy BC_SafeSearch_MSN_Live_Bing_query>
condition=BC_SafeSearch_MSN_Live_Bing_Domains

Assigned values of transaction variables:

bc_notify1=empty1
bc_notify2=empty2

connection: service.name=Explicit HTTP client.address=10.110.99.72 proxy.port=8080

client.interface=255:255.1 routing-domain=default
location-id=0 access_type=unknown
time: 2020-03-17 16:47:37 UTC
CONNECT tcp://autodiscover-s.outlook.com:443/
DNS lookup was unrestricted
user: name="TERNIUM\10519230" realm=AD
authentication start 1 elapsed 0 ms
authorization start 1 elapsed 0 ms
authentication status='none' authorization status='none'
url.category: Lista_Blanca_Office365@Policy;none@YouTube;Business/Economy@Blue
Coat;Email@Blue Coat
total categorization time: 0
static categorization time: 0
server.response.code: 0
client.response.code: 200
application.name: Office 365 Exchange Online
application.operation: none
application.group: none
DSCP client outbound: 65
DSCP server outbound: 65

Transaction timing: total-transaction-time 69221 ms

Checkpoint timings:
new-connection: start 1 elapsed 0 ms
client-in: start 1 elapsed 0 ms
server-out: start 1 elapsed 0 ms
server-in: start 37 elapsed 0 ms
client-out: start 37 elapsed 0 ms
access-logging: start 69221 elapsed 0 ms
stop-transaction: start 69221 elapsed 0 ms
Total Policy evaluation time: 0 ms
url_categorization complete time: 1
client connection: first-response-byte 0 last-response-byte 69221
stop transaction --------------------
start transaction -------------------
transaction ID=9502171 type=http.proxy

<Proxy@req-url> [builtin-prolog:372]
MATCH: variable.bc_notify1(empty1) variable.bc_notify2(empty2)

<Cache@req-url "suppress DRTR for HTML Notification internal URLs"> [vpm-

cpl:3477]
miss: condition=__is_notify_internal

<Proxy@req-url "set notify variables"> [vpm-cpl:3962]

[Rule]
miss: url.regex="(.*)/notify-SplashStreaming\?([^;]+);(.*)"
miss: url.regex="(.*)/accepted-SplashStreaming\?([^;]+);(.*)"
miss: url.regex="(.*)/verify-SplashStreaming\?([^;]+);(.*)"

<Exception@term> [builtin-prolog:246]
MATCH: t_procedure.dashboard_blocked_stats_infinity

<Exception@req-all> [builtin-prolog:237]
MATCH: t_procedure.dashboard_record_hourly

<Exception@req-all> [builtin-prolog:240]
MATCH: t_procedure.dashboard_record_daily

<Exception@req-all> [builtin-prolog:243]
MATCH: t_procedure.dashboard_record_monthly

<Proxy>
miss: client.address=10.110.46.73
miss: condition=__CondList1Combinacion_NOAUTH
MATCH: authenticate(ad) authenticate.force(no) authenticate.mode(proxy-ip)

<Proxy>
miss: condition=__PROTO_3
miss: condition=__PROTO_3
miss: url.port=22
miss: url.port=22

<Proxy>
miss: condition=__CondList1CombinedSourceBloomberg
miss: client.address=Ternium_FTP

<ssl>
MATCH: server.certificate.validate(no)

<Proxy>
miss: client.address=10.110.50.184
MATCH: client.address=10.110.99.72 trace.request(yes)
trace.destination(Annitha)

<Cache>
miss: condition=__CondList1Sitios_SIN_Cache
miss: url.host=r.sascdn.com

<Proxy>
miss: source.port=8194
miss: source.port=8195
miss: source.port=8196
miss: source.port=8197
miss: source.port=8198

<Proxy>
miss: condition=skype

<Proxy>
miss: request.header.If-None-Match="."

<Proxy>
miss: condition=Tunnel_Exception_urld

<Proxy>
MATCH: policy.BC_SafeSearch_Ask_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Google_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_YouTube_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Lycos_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_MSN_Live_Bing_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Yahoo_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_DuckDuckGo_Rules

<Proxy>
MATCH: policy.BC_SafeSearch_Vimeo_Rules

miss: <Proxy> realm=iwa_direct

<Proxy>
miss: condition=SSL_Disabled_Domains

<Proxy "handle HTML Notification internal requests">

miss: [Rule] variable.bc_notify1=variable.bc_notify2
[Rule]
MATCH: action.__delete_notify_cookies(yes)

<Proxy>
miss: http.method=POST
miss: http.method=POST
miss: http.method=PUT
<Proxy>
miss: http.method=CONNECT
miss: http.method=CONNECT

<Proxy>
miss: condition=IWA_SILENT_USERS

<Proxy>
miss: condition=Office365IPs
miss: condition=Office365URLs

<Cache>
miss: condition=Office365IPs
miss: condition=Office365URLs

Called policy definition: BC_SafeSearch_Lycos_Rules

miss: <Proxy BC_SafeSearch_Lycos> url.domain=//lycos.com/
Called policy definition: BC_SafeSearch_Yahoo_Rules
miss: <Proxy BC_SafeSearch_Yahoo_cookies> condition=BC_SafeSearch_Yahoo_Domains
miss: <Proxy BC_SafeSearch_Yahoo_query> condition=BC_SafeSearch_Yahoo_Domains

Called policy definition: BC_SafeSearch_DuckDuckGo_Rules

miss: <Proxy BC_SafeSearch_DuckDuckGo_query> url.domain=//duckduckgo.com/

Called policy definition: BC_SafeSearch_Ask_Rules

miss: <Proxy BC_SafeSearch_Ask_query> condition=BC_SafeSearch_Ask_Domains

Called policy definition: BC_SafeSearch_YouTube_Rules

miss: <Proxy BC_SafeSearch_YouTube_cookies> url.domain=//youtube.com/

Called policy definition: BC_SafeSearch_Vimeo_Rules

miss: <Proxy BC_SafeSearch_Vimeo_cookies> url.domain=//vimeo.com/

Called policy definition: BC_SafeSearch_Google_Rules

miss: <Proxy BC_SafeSearch_Google_query> condition=BC_SafeSearch_Google_Domains
miss: <Proxy BC_SafeSearch_Google_SetPref> condition=BC_SafeSearch_Google_Domains

Called policy definition: BC_SafeSearch_MSN_Live_Bing_Rules

miss: <Proxy BC_SafeSearch_MSN_Live_Bing_cookies>
condition=BC_SafeSearch_MSN_Live_Bing_Domains
miss: <Proxy BC_SafeSearch_MSN_Live_Bing_query>
condition=BC_SafeSearch_MSN_Live_Bing_Domains

Assigned values of transaction variables:

connection: service.name=Explicit HTTP client.address=10.110.99.72 proxy.port=8080

client.interface=255:255.1 routing-domain=default
location-id=0 access_type=unknown
time: 2020-03-17 16:49:05 UTC
GET http://google.com.br/
DNS lookup was unrestricted
Cookie: ANID=AHWqTUns2EHn81lFB0yXUbDzF-7muNBCz-Pl5U5tJLwJhC-kzQ4SQBtlUxmE2MVg
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
user: name="TERNIUM\10519230" realm=AD
authentication start 15 elapsed 0 ms
authorization start 15 elapsed 0 ms
authentication status='none' authorization status='none'
EXCEPTION(my_exception): Either 'deny' or 'exception' was matched in policy
url.category: none@Policy;none@YouTube;Search Engines/Portals@Blue Coat
total categorization time: 0
static categorization time: 0
server.response.code: 0
client.response.code: 403
application.name: none
application.operation: none
application.group: none
DSCP client outbound: 65
DSCP server outbound: 65

Transaction timing: total-transaction-time 16 ms

Checkpoint timings:
new-connection: start 1 elapsed 0 ms
client-in: start 15 elapsed 1 ms
client-out-terminated: start 16 elapsed 0 ms
access-logging: start 16 elapsed 0 ms
stop-transaction: start 16 elapsed 0 ms
Total Policy evaluation time: 1 ms
url_categorization complete time: 15
client connection: first-response-byte 0 last-response-byte 16
stop transaction --------------------
start transaction -------------------
transaction ID=9502944 type=http.proxy