Embedded URL analysis

The embedded URL analysis feature allows the Malware Analysis appliance to extract suspicious URLs that are embedded in a PDF file or a Microsoft Office file within an email message body. When the Malware Analysis appliance extracts a suspicious URL from the PDF file or the Microsoft Office file in an email message, it sends the URL to the URL analysis service for analysis. When guest images updates are downloaded and installed on the Malware Analysis appliance, they are used to extract the suspicious URLs from a Microsoft Office file in an email message during dynamic analysis. Before the Malware Analysis appliance submits the PDF file or the Microsoft Office file for analysis, a verdict is determined for the embedded URL based on custom allowed and blocked lists, Advanced URL Defense, typo squatting, and so forth.

Note

Before the Malware Analysis appliance submits a Microsoft Office file for analysis, a verdict cannot be determined for the embedded URL based on URL Dynamic Analysis (DUA).

If the embedded URL that is extracted from the PDF file or the Microsoft Office file are detected as malicious, the Malware Analysis appliance immediately blocks the email from being delivered to you and marks the malicious email for quarantine.

Note

The embedded URL analysis feature is enabled by default.

Usage guidelines

Trellix recommends that you follow these usage guidelines when you are managing embedded URL analysis: