topic Re: Prevent WildFire scanning certain URLs in General Topics

Prevent WildFire scanning certain URLs

Andy123B — Sat, 03 Jul 2021 15:01:10 GMT

Our external email protection provider (Mimecast) provides safe versions of file attachments on incoming emails. There is also a one time link in the email to request that the original file is sent in case of any formatting issues. When the incoming mails are scanned by WildFire it sometimes follows the link in the email which triggers the release of the email from Mimecast.

Is there a way to filter out scanning / following of links for certain domain names within Wildfire config?

Thanks

Andy

Re: Prevent WildFire scanning certain URLs

Remo — Sat, 03 Jul 2021 15:23:44 GMT

Hi @Andy123B

So you scan the smtp traffic by the firewall and on this traffic you also configured a wildfire profile right?

If yes, then unfortunately there isn't really a (simple) solution otherwise than disabling the wildfire protection on that traffic at all. The not so simple solution is to create a custom app that matches for emails containing such an URL. This way you would be able to create a dedicated policy for this traffic where you do not configure a wildfire profile.

(One of our customers had a similar problem when they did a phishing test. All employees received a phishing email to test if they know the danger of if they simply click the URL in the email. Unfortunately wildifre opened all the URLs so the first test result was totally useless)

Re: Prevent WildFire scanning certain URLs

Andy123B — Sat, 03 Jul 2021 15:47:59 GMT

Thanks for the quick response 🙂

I actually already have something very similar for phising tests, but that is looking for specific content in the Email header. Is there a pattern match "Context" that will search for a string within the email body? I can't find anything that mentions that.

Thanks

Andy

Re: Prevent WildFire scanning certain URLs

Remo — Sat, 03 Jul 2021 16:29:42 GMT

I didn't test it but "smtp-req-protocol-payload" sounds like it could work in your situation.