Cisco Cisco Email Security Appliance C190 White Paper

Enabling URL Services

This section details the procedure for enabling URL services and

reporting options.

Enabling Global Services

Enable the URL Filtering service globally and configure the service to

enable Web Interaction Tracking for URLs rewritten by Content

Filters policies.

Step 1 Log in to the Email Security web interface

Step 2 Select Security Services > URL Filtering > Edit Global Settings

Step 3 Click Enable URL Category and Reputation Filters

Step 4 Click Enable for Web Interaction Tracking

Step 5 Click Submit to submit the changes to the configuration

The URL whitelist option is not needed at this time. This is a global

setting for whitelisting any URLs that are being caught as false positives.

There are whitelisting options in the Content Filter and Outbreak Filters

features that could be used instead.

Next, enable Web Interaction Tracking for Outbreak Filters

Step 6 Select Security Services > Outbreak Filters > Edit Global Settings

Step 7 Click to Enable Web Interaction Tracking

Step 8 Click Submit to submit the changes to the configuration

Step 9 Click Commit and enter a description for these changes. Next,

commit the changes to the configuration

Once the changes are committed, the Cisco IPAS Anti-Spam engine will

start using URL reputation information in its spam scoring. If Outbreak

Filters is configured with Message Modification enabled, it will use the

URL reputation components when inspecting emails.

Configuring Content Filters

Content Filters are administrator-configured sets of conditions and

actions applied to emails being processed. These can be enabled on a

per-policy basis in the Incoming Mail Policies and Outgoing Mail Polices.

Block URLs Based on Web Reputation

Create an incoming Content Filter based on Malicious web reputation

results and defang the URL.

Step 1 Select Mail Policies > Incoming Content Filters > Add Filter

You should see the following screen:

Cisco Email Security How-To Guide

How-To Protect Against URL-Based Attacks

Cisco Public