What is the MSP Gateway Inspection Engine?

The eTrust Content Inspection Gateway component uses packet-processing technology to detect network objects in real-time. It can be configured to work with external applications that capture the network stream and assemble the files for inspection. In the eTrust Content Inspection MSPIE Edition, the Gateway component is configured with Microsoft's Proxy Server. This results in the Microsoft (Gateway) Inspection Engine (MSPIE).

MSPIE Gateway Application

The Gateway application communicates with the Control Center, so that it is updated with the organization's latest security policy. Each Gateway transfers to the Control Center details of objects analyzed; it's source and destination IP addresses, security violations and collisions, including the cause of the violation, and the date and time of analysis.

The organization's security policy is received from the Control Center and enforced at the Gateway level. All communications between the Gateway and the control Center use TCP/IP protocols, and these communications are fully authenticated, as are all communications between any of the eTrust Content Inspection components.

MSPIE Gateway GUI

The Gateway interface lists all objects analyzed at the Gateway, and displays the number of downloadable objects passed and the number rejected, along with the date and time of the latest policy update.

MSPIE Gateway Information

The top section of the Gateway User Interface as shown above, provides the following information:

The name of the Gateway (MSProxy) The Control Center to which the Gateway is connected (Default Control Center) The number of objects analyzed (51), the number of objects rejected (19), the date and the time that the Gateway was last activated, and the date and time when the security database was last updated.

MSPIE Gateway Object Information List

The lower part of the gateway user interface as shown above is the Object Information List, which provides the following information:

Client IP This refers to the name of the Client (workstation) that requested the download, as defined in the security plan. In the example above, the Client IP is 194.90.79.122. Object Name This field displays the URL address and path and filename of the object that was downloaded. In the example above, the Object Name of the first object is http://testing/test/viruses/wsock32.dll/WSOCK32.DLL Status This field indicates whether the object was passed (i.e. executed), rejected (i.e. blocked and therefore not executed), or audited (i.e. logged in the Audit Viewer database). In the example above, the first Object was both passed and audited. Date and Time This field displays the date and time when the object was analyzed. In the example above, the first Object was analyzed on 12/3/00 and the time was 11:35:03 AM