ESA: third-party URL analyzing

[Anatoliy]

Hello!

We're testing the features of ESA C000V now.

In cases when AMP capabilities is not enough:

Is it possible to send URL from email body or attachments to the third-party service for analyzing? Can ESA receive URL analysis results from any third-party applications?

Maybe McAfee, Cuckoo sandboxes?  Through the REST interface? Through the TEXT-based requests?

Or Cisco have its own local solution (not cloud-based)?

Thank you.

[Libin Varghese · Accepted solution]

ESA has a dedicated URL filtering feature that makes use of web based reputation score.

Third party integrations are currently not allowed.

Steps to enable and use URL filtering is available below:

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118775-technote-esa-00.html

Regards,

Libin Varghese

[Robert Sherwin]

The ability to scan URL within a doc/attachment will be included in the 11.1 release.  This will use the same service that is used for currently scanning the email body itself.  We'll treat the URL scoring the same from our WBRS service and category/scoring system.