URL filtering against phishing and outbreak filters

[Henk Fictorie - Ulrich]

We have problems with increasing amounts of phishing emails.

I had a look on what to do about it and it seems that URL filtering is the way to go.

However in the manual it says that:

"To take action based on URL reputation, or to enforce acceptable use policies using message and content
filters:
• The Outbreak Filters feature must be enabled globally"

When I read further it looks that the outbreak filters isn't needed and basic handling can be accomplished using content filters.

So, do I need the Outbreak Filters license or can I do without?

regards Henk Fictorie

[Libin Varghese]

Hi Henk

URL Filtering is a combo of Anti-Spam/Outbreak Filter keys.

It is recommended to have outbreak filters enabled as well, however URL filtering can be enabled with a valid anti-spam license.

Thanks

Libin

[Henk Fictorie - Ulrich]

Thanks, we have anti-spam. I will enable URL filtering and write a content filter and observe whether this helps to get less phishing mails.

In the current setup I already see that the anti-spam engine is dropping lots of those mail, but a significant number gets passed.

I will report back with the results.

Henk

[dmccabej]

Hello Henk,

Just for some further info in case you hit any snags along the way...I've provided our article below that goes over best practices and how to enable URL Filtering, along with creating content filters. Hopefully it helps! :)

ESA URL Filtering Enablement and Best Practices

Thanks!

-Dennis M.