What is the best way to detect a URL rewrite and filter on it?

what is the best way to detect a URL rewrite and filter on it?

Imagine the first step of a workflow is to detect if a URL has a proofpoint rewrite or a safelinks rewrite or neither.

How would you suggest using a filter? a loop? to choose the next action according to what rewrite type (or none)

What do you mean by
“using a filter”

Rewriting the URL to its original form is just a matter of using the appropriate plugin. We have both a proofpoint and safelinks plugin for this.

https://extensions.rapid7.com/extension/proofpoint_url_defense

https://extensions.rapid7.com/extension/microsoft_atp_safe_links

If you could explain your use case a little more, I think we can come up with a solution.