Remove Hyperlink from the Body of the mail

[amith_rao]

Hi,

As we know that one of the Threat Extraction features offer removal of Hyperlink from the attachment of the mail. Similarly is it possible to remove the hyperlink from the body of the mail.

If threat Extraction cannot do this can any other blade offer this feature? 

[HeikoAnkenbrand]

Start here:

ATRG: Mail Transfer Agent (MTA)

[amith_rao]

Hi Heiko

The ATRG helps us understand how MTA works and the blades which can leverage this feature.

Supported blades for MTA feature are as follows: Threat Emulation, Threat Extraction, Anti-virus(R80.10 and above) Anti-Spam & E-mail Security.

But again my requirement is to scrap all the hyperlinks from the body of the Mail irrespective of whether the hyperlinks are genuine or not.

I am pretty much sure that the Threat extraction and Threat Emulation can do this on the attachments but not on the body of the mail.

At the same time, Anti-virus and Anti-bot blades can scan the mail body and only quarantine the Hyperlink found malicious.

But is there any option to quarantine all the hyperlink from mail body whether it is genuine or not? 

Regards

Amith

[Chinmaya_Naik]

Hi Amith,

Refer the below link for more details.

https://community.checkpoint.com/t5/SandBlast-Network/SandBlast-and-links-inside-email/td-p/15798

As I summarize base on the discussion.

In MTA, Threat Emulation work only if that URL end with any file extension, like http://abc.com/xyz.pdf also http://abc.com leads to the PDF file to download (xyz.pdf)

It did not scan if it's not to leads any PDF or any known extension like simple http://abc.com

When enabling AV in MTA then URL reputation is checked over MTA base on the risk level. So if the risk level is  80 or below 80 then that malicious URL is not blocked even that the malicious URL have severity": "Medium", "confidence": "High".

As on the above scenario, URL is bypass but If the customer is using Checkpoint URL Filtering then when the user is open that malicious link its BLOCK by Checkpoint URL Filtering. Because CP URL filtering is working base on severity and confidence level, not by Risk level.

YES we can remove the malicious link from mail body but not sure about remove the all hyperlink that may genuine or not.

Thank You

@Chinmaya_Naik