URL analysis

Administrator Help | Forcepoint Email Security | Version 8.4.x

URL analysis compares a URL embedded in email with a database of categorized URLs, providing category information to allow Forcepoint Email Security to properly handle the URL. Forcepoint Email Security provides the following options for accurate and efficient spam detection:

Threat Intelligence Cloud Service

Filtering Service

Linking Service

Threat Intelligence Cloud Service URL analysis uses the cloud-hosted Forcepoint Master Database, which is the most current repository of classified URLs. This cloud database is used by many Forcepoint solutions to identify potentially dangerous or simply unwanted URLs. This URL analysis service does not require a Forcepoint web protection solution to be installed.

Both the Filtering Service and Linking Service options require the installation of a Forcepoint web protection solution. The Web management server maintains an updated URL master database from the product download server. The email protection system queries the URL category master database and determines the risk level of a URL found in an email message. Note that the Web Security module version must be supported by the Email Security module for this function to be available.

Use the Filtering Service with a Forcepoint on-premises web security solution if you want to access the local copy of the Forcepoint Master Database maintained by your web security product (Forcepoint Web Security or Forcepoint URL Filtering).

Use the Linking Service with a Forcepoint Web Security on-premises solution to access both the local copy of the Master Database as well as any custom categories you have created. This service also provides dynamic category mapping updates from the master database. Because Linking Service is an optional web protection component, you must activate it in Forcepoint Web Security to use this option.

To configure the URL analysis service in the Settings > General > URL Analysis page, specify the URL analysis service you want to use:

Threat Intelligence Cloud Service (default)

Filtering Service

Linking Service

If you select Threat Intelligence Cloud Service:

Click Test Connection to verify the connection to the URL analysis service.

Click the refresh icon for an immediate update to your URL categories list.

If you select Filtering Service:

Specify the location of the master database by entering the IP address or hostname for the Filtering Service.

Click Test Connection to verify the connection to the URL analysis service.

If you select Linking Service:

Specify the location of the master database by entering the IP address or hostname for the Linking Service.

Enter the port number for the Linking Service.

Click Test Connection to verify the connection to the selected URL analysis service.

Click the refresh icon for an immediate update to your URL categories list.

Activate URL analysis in the Main > Policy Management > Filters > Add URL Analysis Filter page by configuring and enabling a URL Analysis filter. See URL analysis for details.