# Situation elements

Situation elements are used in Inspection rules to define patterns that deep packet inspection looks for in traffic.

The Situations tree is constructed differently compared to most other trees. The Situations tree contains several alternative groupings, so most Situations are shown in several places. The groupings allow you to easily find Situations that are specific to the task at hand. For example, Situations specific to the HTTP protocol (some of which are specific to particular web browsers) are stored at the following location in the Situations tree: Situations > By Type > Traffic Identification > Browsers.

Some branches are groupings that you can add to yourself. You can use most of these branches in Inspection rules. The Situation Type groupings are used as the basis for the tree-based Inspection rules configuration in Inspection Policy elements.

Situations and their groupings are updated in dynamic update packages. The following table lists the default branches at the time of writing this document.

Table 1. Default groupings of Situations at the time of publishing this document
Tree branch | Explanation
--- | ---
All Situations | All Situations in the system without any grouping.
By Context | Anti-Malware | Events triggered in the malware scan.
Correlations | Correlation Situations for detecting patterns in event data.
DoS Detection | Situations for detecting DoS (denial-of-service) attacks.
DXL | Legacy situations related to McAfee Threat Intelligence Exchange (TIE). McAfee Threat Intelligence Exchange (TIE) is no longer supported in NGFW 6.10 and higher.
Files | Situations based on identifying file types from traffic. Content identified based on file type fingerprints is redirected to appropriate file streams.
Protocols | Situations that identify protocols from traffic.
Scan Detection | Situations for detecting network scans.
System | System-internal events.
By Tag | By Hardware | Situations that detect something specific to a particular hardware platform grouped by platform (for example, x86 (32-bit) or x86-64 (64-bit)). An example of something hardware specific is an attempt to exploit a known vulnerability that only exists on a particular platform.
By Operating System | Situations that detect something specific to a particular operating system, grouped by operating system (for example, Windows (for all Windows versions) or Windows 2000).
By Situation Tag | Free-form grouping for some special use cases. The Recent Updates branch is especially useful. The branches dynamically list Situations that have been recently added to the system in the 1–5 most recent dynamic update packages. (This list helps in tuning your policies.)
By Software | Situations that detect something specific to a particular software, grouped by brand or product name (for example, Adobe Acrobat or Microsoft Office).
By Type | These Situations are shown as the main Rules tree in the Inspection rules.
By Vulnerability | Situations that detect attempts to exploit known vulnerabilities grouped by vulnerability name.
Custom Situations | Custom Situations that the administrators create. Custom Situations can also appear in the other branches.