Operation: | Add Protection Policy / Edit Protection Policy
Description: | To Add/Edit Protection Policy.To add/edit protection policy.

Sample Configuration
    	<ProtocolSecurity>
    		<Name>Text</Name>
    		<Description>Text</Description>
    		<PassOutlookAnywhere>Enable/Disable</PassOutlookAnywhere>
    		<Mode>Monitor/Reject</Mode>
    		<CookieSigning>Enable/Disable</CookieSigning>
    		<StaticUrlHardening>Enable/Disable</StaticUrlHardening>

    		<!-- If StaticUrlHardening is Enable.-->
    		<EntryURLType>Manual</EntryURLType>
    		<!-- If EntryURLType is Manual.-->
    		<EntryURLList>
    			<EntryURL />
    			:
    		</EntryURLList>

    		<FormHardening>Enable/Disable</FormHardening>

    		<AntiVirus>Enable/Disable</AntiVirus>
    		<!-- If AntiVirus is Enable.-->
    		<AVMode>Avira/Sophos/DualScan</AVMode>
    		<Direction>Uploads/Downloads/UploadsAndDownloads</Direction>
    		<BlockUnscannableContent>Enable/Disable</BlockUnscannableContent>
    		<LimitScanSize>Enable/Disable</LimitScanSize>
    		<Megabytes>Number</Megabytes>

    		<BlockClientsWithBadReputation>Enable/Disable</BlockClientsWithBadReputation>
    		<!-- If BlockClientsWithBadReputation is Enable.-->
    		<SkipRemoteLookups>Enable/Disable</SkipRemoteLookups>

    		<ThreatsFilter>Enable/Disable</ThreatsFilter>
    		<!-- If ThreatsFilter is Enable.-->
    		<RigidFiltering>Enable/Disable</RigidFiltering>
    		<SkipFilterRules>
    			<FilterRules />
    			:
    		</SkipFilterRules>
    		<ThreatFilters>
    			<Filter />
    			:
    		</ThreatFilters>
    	</ProtocolSecurity>

Attribute/Parameter Information :

Parameter | Mandatory | Default | Description
--- | --- | --- | ---
Name | Yes |  | Description: Enter a descriptive name for the Protection Policy object. Name confines to: Type is 'SCALAR'. Datatype is 'STRING'. Comma (,) is not allowed. Maximum characters allowed are 60. UTF-8 character(s) are allowed.
Description | No |  | Description: Enter a description or other information.
Mode | Yes |  | Description: Select a mode from 'Monitor' and 'Reject'. Mode confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'detect', 'deny' are allowed.
ThreatsFilter | No | OFF | Description: Enable to protect webservers from several threats. ThreatsFilter confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
Filter | No |  | Description: Only available when common threat filter is enable. Filter confines to: Type is 'ARRAY'. Datatype is 'STRING'. Maximum characters allowed are 30. Only 'protocol_violations', 'protocol_anomalies', 'request_limits', 'http_policy', 'bad_robots', 'generic_attacks', 'sql_injection_attacks', 'xss_attacks', 'tight_security', 'trojans', 'common_exceptions', 'inbound_blocking', 'outbound', 'outbound_blocking', 'correlation' are allowed. Multiple values are allowed.
RigidFiltering | No | OFF | Description: Enable to tight several of the selected rules. RigidFiltering confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed. Note: Applicable only if 'Common Threat Filter' is enabled..
FilterRules | No |  | Description: Provide the rule number that you want to skip. FilterRules confines to: Type is 'ARRAY'. Datatype is 'INTEGER'. Multiple values are allowed. Note: Applicable only if 'Common Threat Filter' is enabled..
AntiVirus | No | OFF | Description: Enable to protect a webserver against viruses. AntiVirus confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
PassOutlookAnywhere | No | OFF | Description: Enable to allow external Microsoft Outlook clients to access the Microsoft Exchange Server via the WAF. PassOutlookAnywhere confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
CookieSigning | No | OFF | Description: Enable to protects a webserver against manipulated cookies. CookieSigning confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
StaticUrlHardening | No | OFF | Description: Enable to protect against URL rewriting. StaticUrlHardening confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
EntryURLType | No |  | Description: Define type of URL hardening. Default value is Manual. EntryURLType confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'manual', 'sitemap_file', 'sitemap_url' are allowed.
EntryURL | No |  | Description: Add URL for static URL hardening. EntryURL confines to: Type is 'ARRAY'. Datatype is 'STRING'. Maximum characters allowed are 255. Multiple values are allowed. Note: Applicable only if 'Static URL Hardening' is enabled..
FormHardening | No | OFF | Description: Enable to protect against web form rewriting. FormHardening confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
AVMode | No |  | Description: Specifies mode for anti virus values can be Avira,Sophos,Dual Scan. AVMode confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'avira', 'sophos', 'dual' are allowed. Note: Applicable only if 'Anti-Virus' is enabled..
LimitScanSize | No | OFF | Description: Enable to enter the scan size limit. LimitScanSize confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only '0', '1' are allowed. Note: Applicable only if 'Anti-Virus' is enabled..
Direction | No | Uploads | Description: Select whether to scan only up or downloads or both. Direction confines to: Type is 'SCALAR'. Datatype is 'STRING'. Only 'uploads', 'downloads', 'both' are allowed. Note: Applicable only if 'Anti-Virus' is enabled..
BlockUnscannableContent | No | OFF | Description: Enable to block files that cannot be scanned. BlockUnscannableContent confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed. Note: Applicable only if 'Anti-Virus' is enabled..
Megabytes | No |  | Description: Provide the scan size limit in Megabyte. Megabytes confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Note: Applicable only if 'Limit scan size' is enabled..
BlockClientsWithBadReputation | No | OFF | Description: Enable to block clients which have a bad reputation according to their classification, based on GeoIPClosed and RBLClosed information. BlockClientsWithBadReputation confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed.
SkipRemoteLookups | No | OFF | Description: Enable to use GeoIP-based classification. SkipRemoteLookups confines to: Type is 'SCALAR'. Datatype is 'INTEGER'. Only '0', '1' are allowed. Note: Applicable only if 'Block clients with bad reputation' is enabled..

Status Message Information :

Operation | Status | Message
--- | --- | ---
Edit Protection Policy | 200 |
Edit Protection Policy | 500 |
Add Protection Policy | 200 |
Add Protection Policy | 500 |
Add Protection Policy | 502 |

) Copyright 2017 Sophos Limited. All rights reserved.
Sophos is registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.