Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
16-8
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Chapter 16 Protecting Against Malicious or Undesirable URLs
Taking Action Based on the Reputation or Category of URLs in Messages
Taking Action Based on the Reputation or Category of URLs in
Messages
Messages
You can take action based on the reputation or category of URL links in messages using message filters
and content filters in incoming and outgoing mail policies.
and content filters in incoming and outgoing mail policies.
Because Outbreak Filters take many factors into consideration when evaluating messages for malware,
and URL reputation alone may not trigger aggressive message handling, you may want to create filters
based on URL reputation.
and URL reputation alone may not trigger aggressive message handling, you may want to create filters
based on URL reputation.
For example, you can use URL Reputation filters to:
•
Rewrite URLs of neutral or unknown reputation to redirect them to the Cisco cloud Web Security
proxy service for click-time evaluation.
proxy service for click-time evaluation.
•
Drop messages that include URLs that have reputation scores in the Malicious range.
You can use URL Category filters to:
•
Filter categories of URLs to enforce organizational policies for acceptable web use, for example to
prevent users from visiting adult or gambling sites while at the office.
prevent users from visiting adult or gambling sites while at the office.
•
Provide enhanced protection from malicious sites, which may not exist long enough to be classified.
You can redirect all URLs in the Unclassified category to the Cisco cloud Web Security proxy
service for evaluation at the time a user clicks a link.
You can redirect all URLs in the Unclassified category to the Cisco cloud Web Security proxy
service for evaluation at the time a user clicks a link.
Related Topics
•
•
•
•
Using URL-Related Conditions (Rules) and Actions
As always, you must specify a content filter in a mail policy in order to use it.
To Example
Do
This
Take action on the
message as a whole.
message as a whole.
Drop or quarantine messages. Create a URL Reputation or URL
Category condition or rule, then pair it
with any action other than a URL
Reputation or URL Category action.
with any action other than a URL
Reputation or URL Category action.
Exception: Do not pair a URL Reputation
condition or rule with a Bounce action.
condition or rule with a Bounce action.
Modify URLs in a
message, or modify their
behavior.
message, or modify their
behavior.
Replace a URL in the message
with a text note, or make the
URL unclickable.
with a text note, or make the
URL unclickable.
Create a URL Reputation or URL
Category action only; do not use a
separate URL filtering condition.
Category action only; do not use a
separate URL filtering condition.