Embedded URL analysis

The embedded URL analysis feature allows the File Protect appliance to extract suspicious URLs that are embedded in a PDF file or a Microsoft Office file within an email message body. When the File Protect appliance extracts a suspicious URL from the PDF file or the Microsoft Office file in an email message, it sends the URL to the URL analysis service for analysis. When guest images updates are downloaded and installed on the File Protect appliance, they are used to extract the suspicious URLs from a Microsoft Office file in an email message during dynamic analysis. Before the File Protect appliance submits the PDF file or the Microsoft Office file for analysis, a verdict is determined for the embedded URL based on custom allowed and blocked lists, Advanced URL Defense, typo squatting, and so forth.

If the embedded URL that is extracted from the PDF file or the Microsoft Office file are detected as malicious, the File Protect appliance immediately blocks the email from being delivered to you and marks the malicious email for quarantine.