Prevent WildFire scanning certain URLs

[Andy123B]

Our external email protection provider (Mimecast) provides safe versions of file attachments on incoming emails. There is also a one time link in the email to request that the original file is sent in case of any formatting issues. When the incoming mails are scanned by WildFire it sometimes follows the link in the email which triggers the release of the email from Mimecast. 

Is there a way to filter out scanning / following of links for certain domain names within Wildfire config?

Thanks

Andy

[Remo]

Hi @Andy123B 

So you scan the smtp traffic by the firewall and on this traffic you also configured a wildfire profile right?

If yes, then unfortunately there isn't really a (simple) solution otherwise than disabling the wildfire protection on that traffic at all. The not so simple solution is to create a custom app that matches for emails containing such an URL. This way you would be able to create a dedicated policy for this traffic where you do not configure a wildfire profile.

(One of our customers had a similar problem when they did a phishing test. All employees received a phishing email to test if they know the danger of if they simply click the URL in the email. Unfortunately wildifre opened all the URLs so the first test result was totally useless)

[Andy123B]

Thanks for the quick response 🙂

I actually already have something very similar for phising tests, but that is looking for specific content in the Email header. Is there a pattern match "Context" that will search for a string within the email body? I can't find anything that mentions that.

Thanks

Andy

[Remo]

I didn't test it but "smtp-req-protocol-payload" sounds like it could work in your situation.