Cisco Cisco Email Security Appliance C160 Mode D'Emploi

You can take action based on the reputation or category of URL links in messages using message filters 
and content filters in incoming and outgoing mail policies. 

Because Outbreak Filters take many factors into consideration when evaluating messages for malware, 
and URL reputation alone may not trigger aggressive message handling, you may want to create filters 
based on URL reputation. 

For example, you can use URL Reputation filters to: 

Rewrite URLs of suspect or unknown reputation to redirect them to the Cisco cloud Web Security 
proxy service for click-time evaluation. 

Drop messages that include URLs that have reputation scores in the Malicious range. 

You can use URL Category filters to: 

Filter categories of URLs to enforce organizational policies for acceptable web use, for example to 
prevent users from visiting adult or gambling sites while at the office. 

Provide enhanced protection from malicious sites, which may not exist long enough to be classified. 
You can redirect all URLs in the Unclassified category to the Cisco cloud Web Security proxy 
service for evaluation at the time a user clicks a link. 

As always, you must specify a content filter in a mail policy in order to use it. 

Take action on the 
message as a whole. 

Drop or quarantine messages.  Create a URL Reputation or URL 

Category condition or rule, then pair it 
with any action other than a URL 
Reputation or URL Category action. 

Exception: Do not pair a URL Reputation 
condition or rule with a Bounce action. 

Modify URLs in a 
message, or modify their 
behavior.

Replace a URL in the message 
with a text note, or make the 
URL unclickable. 

Create a URL Reputation or URL 
Category action only; do not use a 
separate URL filtering condition.