Email feature extraction allows the Email Security - Server appliance to scan the header and parts of the message body, and then extract the email features such as the sender address, sender domain, number of recipients, number of URLs, number of attachments, domain of the URL, and the original name of an attachment. Based on these features, the appliance determines whether the email should be submitted for further analysis to the Trellix Advanced URL Detection Engine (FAUDE), email YARA analysis, or static analysis. The features in the email can help to detect malware.
Email feature extraction
- Published on Aug 24, 2026
- 1 minute(s) read
Was this article helpful?
Related articles
- Email Security - Server > Email Security - Server User Guide Release 11.x > Configuration > Email Policy Configuration > Email feature extraction
- Email Security - Server > Email Security - Server 11.x Release Notes
- Email Security - Server > Email Security - Server User Guide Release 11.x > Configuration > System configuration > Password extraction > Password candidate extraction
- Email Security - Server > Email Security - Server 10.x Release Notes