cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3368
Views
5
Helpful
3
Replies

URL Filtering: Log all URL seen by the ESA

REJR77
Level 1
Level 1

Hello,

Our customer would like to know if there a way to log all URLs seen by the ESA during email inspection?

I mean even if the ESA thinks the URL is not malicious we would like to get a trace of all url so that we can investigate in case a user receive something bad.

The idea would be that by searching the URL in the logs we can see which users received it.

 

I was thinking of an URL reputation content filter with a condition:

if URL Reputation is -10;10 or noscore then add a log entry.

But does this dramaticaly use more ressources on the appliance? and is it a best practices ?

 

Thanks for any advices

 

 

1 Accepted Solution

Accepted Solutions

marc.luescherFRE
Spotlight
Spotlight