The EMPS_URL_SCAN license enables the Email Security - Server appliance to scan URLs that are sent through email that link to suspicious or malicious files. This feature protects against spear phishing emails used in targeted attacks. After malware is identified, the appliance quarantines the malicious email that contains the malicious URLs for further analysis or deletion.
Starting with 8.1.0, Email Security - Server appliance URL scanning extracts FTP and other non-http URLs from the body of HTML emails, if the URLs are HREF and clickable.
Starting with 8.4.1, data: scheme URLs within an email body are processed as attachments through the EMPS_ATTACHMENT_SCAN license.
You can track the number of malicious URLs by using the What's Happening panel of the Email Security - Server dashboard.