Open with table of contents

Creating a Suspicious URL List

The Suspicious URL List is a managed group of URLs which are potentially a known threat. You can configure how the Gateway applies these, using a number of rules.

You can add a Suspicious URL List to a Which Message Types clause in the What To Look For? section of a content rule.

Tell me about...

• Suspicious URL List Rules.

  You can select any combination of rules to apply to a Suspicious URL List:

  • URLs containing an IP address instead of a hostname
  • URLS containing encoded characters in the hostname: for example, a URL containing % characters.
  • URLs containing authentication details: for example, ftp://username:password@address
  • URLs purporting to be secure that are not: for example, a URL prefixed with https:// that is not recognized as secure.
  • URLs to non-standard port numbers: for example, a port number which is not expected for the given protocol of the URL.
  • URLs to local files: any URL prefixed with file://...
  • URLs that contain (and possibly redirect to) other URLs

How do I...

• Create a Suspicious URL List?

  1. From the Policy Center Home page, click URLs. The Manage URL Lists page is displayed.

  2. Click New adjacent to the URLs header. The Choose URL List Type? dialog is displayed.

     You can also click New URL in the What would you like to do? panel.

  3. Select Suspicious URL List and click Create.

  4. Use the Overview section to add a Name and optional Notes for the Custom URL List. To edit these details:

• Add a new URL to a URL List?

  You cannot add a URL to a Suspicious URL List. This list is managed dynamically by the Gateway. However, you can adapt the rules to configure how the list of Suspicious URLs is applied to your security policy.

• Adapt the Rules of a Suspicious URL List?

  You can select rules which determine how the Suspicious URL List is applied. In the Rules section, select the rules you want to apply or select All rules to apply them all by default.

  Click Save.