About URL dynamic analysis

The URL Dynamic Analysis feature allows the Email Security - Server appliance to analyze and dynamically scan URLs within an email message body that point to objects such as ZIP, EXE, PDF, DOC, and DOCX file types. The URL is compared against a set of heuristic rules to determine whether the URL is suspicious. Based on its internal security rules, the Email Security - Server appliance downloads the object from the referenced URL and submits it to the MVX (Multi-Vector Virtual Execution) engine for further analysis. If the object is detected as malicious, the Email Security - Server appliance immediately blocks the email from being delivered to you and marks the malicious email for quarantine. If the URL is the only object within the message body and is detected as nonmalicious, the Email Security - Server appliance does not block the email from being delivered to you.

When URL Dynamic Analysis is enabled, the Email Security - Server appliance can also identify malicious shortened URLs (for example, j.mp, tinyurl.com, or bit.ly) that are embedded in an email message body. You can prevent access to these shortened URLs, which may point to sites that contain malware.

You can exclude URLs from analysis by adding their domains to a custom domain whitelist.

Note

URL Dynamic Analysis is sometimes referred to as DUA or Dynamic URL Analysis in Trellix documentation.

Note

URL Dynamic Analysis is disabled by default.

Note

If an appliance is deployed behind a Network Security appliance, Trellix recommends you whitelist the IP address of the appliance. This will prevent the Network Security appliance from alerting the that it is downloading malicious content. For more information about whitelisting, see the Network Security User Guide.

Note

Network configuration parameters can be modified to support an interface on a subnet different from the management interface.

Task list for managing URL dynamic analysis

Complete the tasks for managing URL Dynamic Analysis in the following order: