Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
16-9
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Chapter 16 Protecting Against Malicious or Undesirable URLs
Taking Action Based on the Reputation or Category of URLs in Messages
Filtering by URL Reputation or URL Category: Conditions and Rules
You can perform actions on messages based on the reputation or category of URLs in the message. If
you want to perform any action other than modifying URLs or their behavior, add a URL Reputation
or URL Category condition and select the reputation scores or URL categories for which you want to
apply the action.
you want to perform any action other than modifying URLs or their behavior, add a URL Reputation
or URL Category condition and select the reputation scores or URL categories for which you want to
apply the action.
For example, if you want to apply the Drop (Final Action) action to all messages that include URLs in
the Adult category, add a condition of type URL Category with the Adult category selected.
the Adult category, add a condition of type URL Category with the Adult category selected.
If you do not specify a category, the action you choose is applied to all messages.
URL reputation score ranges for clean, neutral, and malicious URLs are predefined and not editable.
However, you can specify a custom range instead. The specified endpoints are included in the range you
specify. For example, if you create a custom range from -8 to -10, then -8 and -10 are included in the
range. Use “No Score” for URLs for which a reputation score cannot be determined.
However, you can specify a custom range instead. The specified endpoints are included in the range you
specify. For example, if you create a custom range from -8 to -10, then -8 and -10 are included in the
range. Use “No Score” for URLs for which a reputation score cannot be determined.
Note
Neutral URL reputation means that URLs are currently clean, but may turn malicious in future, as they
are prone to attacks. For such URLs, administrators can create non-blocking policies, for example,
redirecting them to the Cisco Web Security Proxy for click-time evaluation.
are prone to attacks. For such URLs, administrators can create non-blocking policies, for example,
redirecting them to the Cisco Web Security Proxy for click-time evaluation.
URLs that are included on the selected URL whitelist or on the global URL whitelist not evaluated.
The action that you pair with this condition is taken if any URL in the message matches the reputation
score or any category specified in the condition.
score or any category specified in the condition.
If you want to modify URLs in a message, or modify their behavior, configure only a URL Reputation
or URL Category action. You do not need a separate URL Reputation or URL Category condition or rule
for this purpose.
or URL Category action. You do not need a separate URL Reputation or URL Category condition or rule
for this purpose.
Note
Do not pair a URL Reputation condition with a Bounce action.
Tip
To check the category of a particular URL, visit the link in
.
Related Topics
•
•
•
•
Modifying URLs in Messages: Using URL Reputation and URL Category Actions
in Filters
in Filters
Use a URL Reputation or URL Category action to modify URLs in a message, or their behavior, based
on the reputation or category of the URL.
on the reputation or category of the URL.