URL analysis

Administrator Help | TRITON AP-EMAIL | Version 8.2.x

URL analysis analyzes email content for embedded URLs and classifies them according to a Forcepoint database of known spam URLs. When you select the URL analysis filter type in the Main > Policy Management > Filters > Add (or Edit) Filter page, mark the URL analysis check box to display a list of URL categories in the Filter Properties area. Select the URL categories that you want to detect. When the filter detects a URL in a message from a selected category, it applies any configured filter response.

This filter is available only when your system includes a Forcepoint Web protection solution and a download server is configured. See URL analysis with Forcepoint Web protection solutions for more information about integrating with Forcepoint Web solutions to use this filter.


	Note A filter action option of "Resume message analysis" is available so that message analysis can continue after a URL match is detected. See Creating and configuring a filter action for information.

Select the URL categories you want the filter to detect in the URL Categories list by marking the appropriate check boxes. Mark the All check box to select all URL categories in the list.

Configure any of the following filter responses:

Replace matching URLs with. Mark this check box to enable the filter to replace a URL in a message from a target category with a text string. Enter the replacement text in the entry field to the right of the check box (maximum length is 128 characters).


	Note When a matching URL is detected during message analysis, the rest of the message is not examined by the URL filter and a subsequent URL may not be replaced. For example, if a URL is detected in a message header, the message body is not analyzed, and the URL in the message body will not be detected and replaced.

Bypass URL analysis if message size exceeds. If you want message size to determine whether URL analysis is bypassed, mark this check box and enter a message size in KB (default is 128).

Dashboard charts summarize the instances of embedded URLs that are detected. See Available dashboard charts for the names of these charts.