URL analysis

URL analysis examines email content for embedded URLs and classifies them according to a Forcepoint database of known spam URLs. When the filter detects a URL in a message from a selected category, it applies any configured filter response, such as removing the URL or modifying the URL to neutralize it. Configure the URL analysis filter on the page Main > Policy Management > Filters > Add (or Edit) Filter.

This filter uses one of the following services to perform URL analysis:

• Threat Intelligence Cloud Service, the cloud-hosted Forcepoint URL Database of classified URLs.
• Filtering Service, used to access the local copy of the Forcepoint URL Database maintained by your web security product (Forcepoint Web Security or Forcepoint URL Filtering).
• Linking Service, used with a Forcepoint Web Security on-premises solution to access the local copy of the URL Database as well as any custom categories you have created. This service also provides dynamic category mapping updates from the database.

The Filtering Service URL analysis performance can be more efficient than the Linking Service because the Filtering Service can perform bulk URL queries, whereas the Linking Service cannot. See URL analysis for more information about selecting a URL analysis service and integrating with Forcepoint Web Security solutions.

Dashboard charts summarize the instances of embedded URLs detected by the filter. A URL Analysis message type appears in the message type or message analysis result fields in presentation reports and dashboard charts. See Available dashboard charts.

When the URL analysis filter triggers, the default action is to drop the message and save it to the spam queue, where it may be released and delivered by a Personal Email Manager user. As a result, a message that contains a malicious link may be delivered to an inbox in your network.

Multiple URL analysis policy rules can be configured to detect and contain malicious URLs so that they cannot be released by a Personal Email Manager end user. When you configure a URL Analysis filter for this case, ensure that all Security URL categories are selected in the URL Categories list. See Managing filter actions to create a URL analysis filter action for handling email that may contain a malicious URL.