Hi Pratham,
we have a dedicated policy quarantine for malicious URLs. It holds only email that contain malicious URLs, nothing else. We did this by creating a separate quarantine and then use content filters to quarantine mails with malicious URLs into it. No other content filter or feature stores mails in that particular quarantine.
Result: That quarantine has thousands of mails in it (past 30 days), while the URL filter report shows only 200 for the same timeframe.
I seem to remember that someone here on this forum once said that the reporting feature of ESA has a problem, where mails that were already registered as spam will only show in the reports as spam, even if they contained other threats.
