Cisco ESA Suspected URL

[ccna_security]

Dear all. 

I configured url filtering and added -5 -3 (Custom Range) for Suspected url. But some emails (with legitimate urls inside it) get blocked by esa due to newly created suspected url content filter. Could you please tell me how can I see the exact score that URL filter observe and thinks that this is suspected url.

And do you think that best approach is to decrease Custom Range for example -5 -1 ?

[ppreenja]

Hello CCns90,

You can configure logging of the URL in the mail logs/message tracking by enabling the same in outbreakconfig via CLI.
Please find below the steps for the same:

myESA> outbreakconfig

Outbreak Filters: Enabled

Choose the operation you want to perform:
- SETUP - Change Outbreak Filters settings.
[]> SETUP

Outbreak Filters: Enabled
Would you like to use Outbreak Filters? [Y]>

Outbreak Filters enabled.
.
.
.
.
Logging of URLs is currently disabled.

Do you wish to enable logging of URL's? [N]> Y

Enable the logging as seen above.

I hope this helps!

Cheers,
Pratham

[ccna_security]

Thank you. Is it possible to create URL logging by configuring Content Filter? Add Log Entry for example? If I configured it, will it show me exact information about the reason why esa blocks legitimate URL?

[ppreenja]

Hello CCns90,

In the content filter, you have the option of selecting the URL reputation range condition and take the action on the same accordingly.

You can have a custom log entry created in the action so that you can come to know the given content filter was hit and since the URL reputation was falling in the same range and hence it was acted upon by the filter.
Hence, you can put a custom entry to know the reason.

With the URL logging enabled, you will be able to see the URL reputation score in the message tracking as well which should be falling in the given customer range in the condition of the content filter.

Please find attached the sample example screenshot for the same.

Cheers,
Pratham

[ccna_security]

Hi Pratham

as I understand you recommend to create Custom entry log in content filter and enabling URL logging via CLI. Right?

One last think please explain what is the difference between Log Entry and URL logging?

[ppreenja · Accepted solution]

Hello CCns90,

Log entry is the custom entry which you can modify as per your requirement i.e. you can consider it as a kind of text that you would like to see in the message tracking if a given content filter is being hit.

URL Logging will show you the score of the URL (which was sent in the email) in the message tracking.

I hope the above explains.

Cheers,
Pratham

[ccna_security]

That is all . I got what I need. thank you so much