Adds a rule to a custom blacklist based on the RegEx URL.
A blacklist allows you to control which messages that contain an attachment must be considered malicious based on the matched known rule entries. The appliance immediately marks the attachment within an email message for quarantine if it includes the URL.
You can add up to 10,000 blacklist entries to the appliance database.
Syntax
[no] analysis custom blacklist regex url <URL>
Parameters
no
Use the no form of this command to delete a rule from the custom blacklist based on the RegEx URL.
<URL>
The specific URL that is added as a blacklist rule.
Example
This example adds the URL "/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&amp;//=]*)" to a custom blacklist:
hostname (config) # analysis custom blacklist regex url /\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)
The following example deletes the URL "/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&amp;//=]*)" from a custom blacklist:
hostname (config) # no analysis custom blacklist regex url /\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Malware Analysis: Release 11.0.0
Email Security — Server: Release 11.0.0
Network Security: Release 11.0.0