Symantec Site Review and Edge SWG appliance return different categories for websites.

Products

• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS

Issue/Introduction

Symantec Site Review returns a different category for a URL than when tested on the Edge Secure Web Gateway (formerly ProxySG) appliance:

Management Console > Configuration > Content Filtering > General > Diagnostics

For example, testing the URL www.mycompany.com.au on the Edge SWG appliance results in "none", but testing from Site Review gives a different result:

The page you want reviewed is http://www.mycompany.com.au/    (Check another site)
This page is currently categorized as Travel This page was rated by our WebPulse system

Cause

This behavior is expected.

The message "This page was rated by our WebPulse system" means that categorization was done dynamically and the Blue Coat WebFilter (BCWF/BCIS) database does not contain this URL. 

When you request a URL that has not already been categorized by the BCWF database (for example, a new Web site), the WebPulse dynamic categorization service queries the target Web site and retrieves the page’s content. WebPulse analyzes the page’s content and context in search of malicious content. If malicious content is found, an appropriate category (for example, Spyware/Malware sources or Phishing) is returned. If no malicious content is found, WebPulse’s dynamic real time rating (DRTR) service determines the language of the page, a category for the page, and a confidence factor that the category is correct. If the confidence factor is high, the calculated category is returned. 

In situations where the dynamic categorization service cannot categorize a URL with enough confidence to dynamically return a category with a high confidence level, the category rating request for the particular page is labelled none. 

All URLs received by WebPulse that are not categorized in the BCWF database are logged and forwarded to Symantec’s centralized processing center, where they are prioritized for rating by a series of automated URL analysis tools and/or human analysis. These ratings are then used to update the master BCWF database, and the automatic database update feature then refreshes the local BCWF database on the Edge SWG appliance. 

 

Resolution

If you encounter this issue again, the workaround is to submit the URL to the Symantec WebPulse Site Review Request Process, which will ensure the site is rated with priority rather than waiting for the automated rating.