about the URL detection

DailyDairy

Hi ,

I would like to ask a question regarding the detection feature in Collaboration Protection.

In our environment, we frequently see detection results indicating harmful URLs, with severity levels ranging from low to high.

What I would like to understand is:

Based on what logic are these URLs identified as harmful, and how are they classified into different severity levels?

Are there any specific evaluation criteria or rules behind this classification?
For example, is it based on threat intelligence feeds, behavioral analysis, reputation scoring, or other mechanisms?

If anyone has insights or experience with how this detection works in practice, I would really appreciate it if you could share.

Thank you in advance!

————————————————————————————————

皆様

Collaboration Protectionの検知（detection）機能について質問させていただきます。

弊社環境では、有害と判定されたURLの検知が頻繁に発生しており、
そのリスクレベルも「低」から「高」までさまざまに分類されています。

そこで、以下の点について教えていただけますでしょうか。

これらのURLはどのようなロジックに基づいて有害と判定され、
また、どのようにリスクレベルが分類されているのでしょうか。

具体的には、脅威インテリジェンス、挙動分析、レピュテーション評価など、
どのような基準や仕組みによって判断されているのかを知りたいと考えております。

本機能について実際の運用経験や知見をお持ちの方がいらっしゃいましたら、
ご教示いただけますと幸いです。

何卒よろしくお願いいたします。

Hamid

Hello,

In WithSecure™ Elements Collaboration Protection, the identification and classification of URLs are handled by the WithSecure Security Cloud using a multilayered approach.

1. Detection Logic: How are URLs identified?

The system doesn't rely on just one method; it combines several real-time mechanisms:

• Reputation Scoring & Threat Feeds: URLs are instantly checked against a global database of known malicious sites, phishing pages, and "unwanted" content.
• Heuristic & Machine Learning Analysis: The system looks for "fingerprints" of malicious intent. For example, it analyzes the structure of the URL and the behavior of the destination page to catch brand-new (zero-day) phishing sites that haven't been blacklisted yet.
• Recursive Redirection Analysis: Attackers often hide harmful links behind multiple redirects or URL shorteners. Our engine "follows" these links to the final destination to ensure the end-point is safe.

2. Severity Classification: Why Low, Medium, or High?

The severity level is actually a "smart" indicator that combines the danger of the URL with the action taken by your policy:

• High Severity: This is assigned when a harmful URL is detected but no restrictive action was taken (e.g., your policy is set to "Take no action" or "Subject modified"). It’s marked High because the threat is still sitting in the user's inbox and requires your immediate attention.
• Medium Severity: This is the standard level for harmful URLs that were successfully blocked or moved to Quarantine. Since the threat is mitigated, it is considered a medium priority for review.
• Low Severity: This is typically used when a URL is flagged as suspicious but originates from a trusted sender, suggesting a lower risk of a targeted attack.

I hope this helps!