Threat Extraction - click here location

Jeroen_Demets — Tue, 06 Nov 2018 12:55:50 GMT

Hi,

what are you folks using as Main URL to allow users to get the original attachments?

When Threat Extraction is active, you can configure it so that users can get the original attachment by clicking "here" in the banner that they see in the mail.

The configuration for the target of "here" is not done in the Threat Extraction config settings but under "UserCheck" in the gateway configuration.

I was using a FQDN that points to the LAN interface of the firewall gateway but that of course doesn't help users external of the gateway (like home users, or on mobile devices).

So should we use an external URL? What are you using? Does this have security implications?

UserCheck is also used for other things, should we expect a new issue?

Regards,
Jeroen

Re: Threat Extraction - click here location

G_W_Albrecht — Tue, 06 Nov 2018 15:09:17 GMT

This and more can be found in sk114806: ATRG: Threat Emulation

Re: Threat Extraction - click here location

Jeroen_Demets — Wed, 07 Nov 2018 07:57:50 GMT

I know that sk but I must be looking over the exact info. Can you be more specific please?

topic Threat Extraction - click here location in Firewall and Security Management

Threat Extraction - click here location

Re: Threat Extraction - click here location

Re: Threat Extraction - click here location