Outbreak Filters

[ymejia@tarjetaexito.com.co]

When in the body of the message has a link to an url and it downloads a .pdf or .doc file or whatever the extension and this is a malicious file, CISCO MAIL SECURITY analyzes this file ???

[ymejia@tarjetaexito.com.co]

C100V

[Ken Stieers]

No. The ESA does not download the file and analyze it.

The ESA may know that the URL has a bad reputation and will act on that, but it doesn't follow it and download the payload.

[Robert Sherwin]

One article that may be helpful to you for this:

Testing Outbreak Filter URL Rewriting

If there is a URL that is suspicious, be sure to have URL Filtering turned on, and the URLs themselves written into mail logs:

ESA URL Filtering Enablement and Best Practices

With AsyncOS 11.1 - Email Security will now scrutinize URL shortened links as well.