what is the best way to detect a URL rewrite and filter on it?
Imagine the first step of a workflow is to detect if a URL has a proofpoint rewrite or a safelinks rewrite or neither.
How would you suggest using a filter? a loop? to choose the next action according to what rewrite type (or none)
What do you mean by
“using a filter”
Rewriting the URL to its original form is just a matter of using the appropriate plugin. We have both a proofpoint and safelinks plugin for this.
https://extensions.rapid7.com/extension/proofpoint_url_defense
https://extensions.rapid7.com/extension/microsoft_atp_safe_links
If you could explain your use case a little more, I think we can come up with a solution.
1 Like