HES provides Time-of-Click Protection against malicious URLs in email messages. If you enable Time-of-Click Protection, HES rewrites URLs in email messages for further analysis. Trend Micro analyzes those URLs at the time of click and will block them if they are malicious.
Time-of-Click Protection detects link-based malware and phishing attacks by analyzing the reputation of a URL at the time of click of users on their endpoints and not only at the time of delivery to HES.
Time-of-Click Protection just works on Inbound direction.
To enable Time-of-Click Protection:
Create an inbound protection policy to enable Web Reputation, if the Web Reputation detection in the policy is already enabled, check the Web Reputation setting of the policy.
Click on Web Reputation. The Web Reputation Settings window appears.
Tick Enable Time-of-Click Protection checkbox.
Click image to enlarge
- Save the settings. Once the policy change is complete, submit the policy.
Check if you need adjust the Time-Of-Protection Settings:This step (step 4) is optional, HES provides default settings to all customers.
- Go to Inbound Protection > Time-of-Click Protection.
Under Time-of-Click Protection Settings, do the following:
- Select an action (Allow, Warn or Block) to take on dangerous URLs. The default value is Block.
- Dangerous URLs are verified to be fraudulent or known sources of threats.
- Select an action ( Allow, Warn or Block) to take on highly suspicious URLs. The default value is Block.
- Highly suspicious URLs are suspected to be fraudulent or possible sources of threats.
- Select an action ( Allow, Warn or Block) to take on suspicious URLs. The default value is Warn.
- Suspicious URLs are associated with spam or possibly compromised.
- Select an action ( Allow, Warn or Block) to take on untested URLs. The default value is Warn.
- While Trend Micro actively tests URLs for safety, users may encounter untested pages when visiting new or less popular websites. Blocking access to untested pages can improve safety but can also prevent access to safe pages
- Click Save.