About URL click reporting

When the Email Security - Server appliance identifies a suspicious URL within an email message body, it redirects the URL to the Dynamic Threat Intelligence (DTI) Cloud for a complete analysis. In addition, if URL rewriting is enabled and if not detected as malicious by the Trellix Advanced URL Detection Engine (FAUDE), the Email Security - Server appliance rewrites all URLs in the email .

While FAUDE is in the process of analyzing URLs found in the email, the URL Click Reporting feature on the Email Security - Server appliance generates a URL click event when a rewritten URL within an email message body is clicked by the recipient. The click event data (such as the count of number of URLs clicked, time stamp, recipient, and type) is gathered and analyzed using Trellix Helix and third-party software.

The types of URL click events generated and displayed on the eAlerts > Alerts detail page are:

When a missed URL click event is created retroactively, the URL click data is delivered as part of the retroactive response for that particular URL and the event is updated.

The URL Click Reporting feature is enabled by default and displayed in the appliance Web UI only.

For information about Advanced URL Detection, see About advanced URL defense.

For information about retroactive alerts, see Retroactive detection.

URL Click Reporting is enabled on the appliance by default.

Prerequisites