Cisco Cisco Web Security Appliance S160 User Guide

N/A (Part of the ACL 
decision tag)

PolicyGroupName

Name of policy group responsible for the final decision on this 
transaction (Access Policy, Decryption Policy, or Data Security 
Policy). When the transaction matches a global policy, this 
value is “DefaultGroup.”

Any space in the policy group name is replaced with an 
underscore ( _ ).

N/A (Part of the ACL 
decision tag)

Identity

 

Identity policy group name.

Any space in the policy group name is replaced with an 
underscore ( _ ).

N/A (Part of the ACL 
decision tag)

OutboundMalwareScanning

Policy

 

Outbound Malware Scanning Policy group name.

Any space in the policy group name is replaced with an 
underscore ( _ ).

N/A (Part of the ACL 
decision tag)

DataSecurityPolicy

 

Cisco IronPort Data Security Policy group name. When the 
transaction matches the global Cisco IronPort Data Security 
Policy, this value is “DefaultGroup.” This policy group name 
only appears when Cisco IronPort Data Security Filters is 
enabled. “NONE” appears when no Data Security Policy was 
applied.

Any space in the policy group name is replaced with an 
underscore ( _ ).

N/A (Part of the ACL 
decision tag)

ExternalDLPPolicy

 

External DLP Policy group name. When the transaction 
matches the global External DLP Policy, this value is 
“DefaultGroup.” “NONE” appears when no External DLP 
Policy was applied.

Any space in the policy group name is replaced with an 
underscore ( _ ).

N/A (Part of the ACL 
decision tag)

RoutingPolicy

 

Routing Policy group name as 
ProxyGroupName/ProxyServerName.

When the transaction matches the global Routing Policy, this 
value is “DefaultRouting.” When no upstream proxy server is 
used, this value is “DIRECT.”

Any space in the policy group name is replaced with an 
underscore ( _ ).

%Xr

<IW_comp,6.9,-,"-",-,-,-,-,"

-",-,-,-,"-",-,-,"-","-",-,-

,IW_comp,-,"-","-","Unknown"

,"Unknown","-","-",198.34,0,

-,[Local],"-",37,"W32.CiscoT

estVector",33,0,"WSA-INFECTE

D-FILE.pdf","fd5ef49d4213e05

f448f11ed9c98253d85829614fba

368a421d14e64c426da5e”>

Scanning verdict information. Inside the angled brackets, the 
access logs include verdict information from various scanning 
engines.

For more information about the values included within the 
angled brackets, see 

.

%?BLOCK_SUSPECT
_USER_AGENT,
MONITOR_SUSPECT
_USER_AGENT?%
<User-Agent:%!%-%.

-

Suspect user agent.