Import an HTTP Inspection Filter Parent topic

Two types of HTTP Inspection filters can be imported:
  • New filters created by the users in a text file outside of IWSVA
  • Custom filters created by Trend Micro support
Filter files are XML files. Imported filter files must conform to a defined standard shown below.
Creating a filter to import:
  1. Imported filter XML files can be created in several ways:
    • Exported from IWSVA
    • Created as a new file
  2. If you are creating a new file, use the following sample format:
    <?xml version="1.0" encoding="UTF-8"?>

<SDF>

    <Filter Mode="Basic" Name="Browser type filter" ID="1">

        <Note>Identifies requests sent from the FireFox browser according to the user-agent header</Note>

        <Basic Type="REQ">

            <Headers Enable="true">

                <Header Value="Firefox" Op="M" Name="User-Agent"/>

            </Headers>

        </Basic>

    </Filter>

    <Filter Mode="Basic" Name="Large data upload filter" ID="3">

        <Note>Identifies large file uploads according to the content-length header</Note>

        <Basic Type="REQ">

            <Headers Enable="true">

                <Header Value="1048576" Op="GE" Name="Content-Length"/>

            </Headers>

        </Basic>

    </Filter>

    <Filter Mode="Basic" Name="Query keyword filter" ID="4">

        <Note>Identifies query keyword for search engine website, etc.</Note>

        <Basic Type="REQ">

            <Query Enable="true">

                <Value><![CDATA[[put query keywords here]]]></Value>

            </Query>

        </Basic>

    </Filter>

</SDF>
To import a filter:
  1. Go to HTTP > HTTP Inspection > Filters.
  2. Click the Import link.
  3. Click Browse and specify the path and filter to be imported.
  4. Click Import.
  5. View the name of the imported filters in the list of filter names.
See also