The URL overlay detection feature allows the Email Security - Server appliance to identify suspicious mismatches between the URLs that are embedded in an email message.
URL overlay is a technique that hides a URL that points to a phishing site under a different, visible URL. When users click the visible link, they might be lead to a website that contains malware. The URL is compared with a list of URL overlay characteristics. The URLs that match the characteristics of domain mismatches, URL text string mismatches, or protocol mismatches are submitted for URL Dynamic Analysis. If dynamic analysis determines the URL is malicious, the results of the analysis are displayed on the eAlerts > Alerts page in the Web UI.
Note
URL overlay detection is enabled by default.
Important
Trellix recommends that you do not use URL overlay detection if all the URLs are rewritten by a third-party email gateway. Instead, choose one of the following options:
Disable URL Overlay detection. Use the
no email-analysis policy url-overlay enablecommand.Add the sender domain of the rewritten URL to an allowed list by using the Settings > Allowed List page in the Web UI or the
email-analysis allowed-list sender-domain <domain_name>command. For details, see Configuring rules on an allowed list.