cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.0.1-033
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.1.0-227
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

306
Views
0
Helpful
2
Replies
SomeOtherITGuy
Beginner

Scanning URLs within email bodies/subjects/attachments for strings

Hello all!!!!!

 

I have a very specific but critical use case for scanning URLs within emails and then taking action on them if they contain a certain string. 

 

I need the detection of the URL contents to work even if it's in a hyperlink and preferably if it's within an attachment too. 

 

I can see incoming content filters for message body contains text. Does anybody know if this will detect URLs in the message body and especially if they're hyperlinked? 

 

Can test this myself next week but it anybody knows I'd be grateful for the answer ahead of then!

 

All the best

 

 

2 REPLIES 2
Steflstefan
Beginner

Hello

 

add a dictionary with suitable REGEX strings like
http:\/\/.*\.example\.com\/
https:\/\/.*\.exampe\.com\/

 

add a filter
if (dictionary-match("URL-Dictionary", 1)) { quarantine("URL-Quarantine"); log-entry("Matched Content: $MatchedContent"); }

 

Grz

S.

Hi Steflstefan.

 

Thank you for your reply. 

 

So I have been testing this and this approach will work but only if the URL exists in the body as text. It doesn't seem to work if there are button links or hyperlinks in the email. 

 

I think this is a limitation of the appliance. We know it can read URLs embedded in email because it looks up their reputations but we don't have any options for scanning them for specific strings which is a shame. 

 

All the best

 

 

Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: ISE Demo (100%)

Content for Community-Ad