07-03-2021 08:01 AM
Our external email protection provider (Mimecast) provides safe versions of file attachments on incoming emails. There is also a one time link in the email to request that the original file is sent in case of any formatting issues. When the incoming mails are scanned by WildFire it sometimes follows the link in the email which triggers the release of the email from Mimecast.
Is there a way to filter out scanning / following of links for certain domain names within Wildfire config?
07-03-2021 08:23 AM
So you scan the smtp traffic by the firewall and on this traffic you also configured a wildfire profile right?
If yes, then unfortunately there isn't really a (simple) solution otherwise than disabling the wildfire protection on that traffic at all. The not so simple solution is to create a custom app that matches for emails containing such an URL. This way you would be able to create a dedicated policy for this traffic where you do not configure a wildfire profile.
(One of our customers had a similar problem when they did a phishing test. All employees received a phishing email to test if they know the danger of if they simply click the URL in the email. Unfortunately wildifre opened all the URLs so the first test result was totally useless)
07-03-2021 08:47 AM
Thanks for the quick response 🙂
I actually already have something very similar for phising tests, but that is looking for specific content in the Email header. Is there a pattern match "Context" that will search for a string within the email body? I can't find anything that mentions that.
07-03-2021 09:29 AM
I didn't test it but "smtp-req-protocol-payload" sounds like it could work in your situation.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!