ATD / IS receives a large number of URL samples from Email Connector

Technical Articles ID: KB93820
Last Modified: 2023-05-09 12:17:59 Etc/GMT

Environment

Advanced Threat Defense / Intelligent Sandbox (ATD / IS) 4.12
Email Connector systemex 4.12.0.7

Problem

ATD / IS receives many URL samples from the Email Connector.

System Change

You installed ATD / IS 4.12 and ATD / IS 4.12 Email Connector systemex 4.12.0.7.

Cause

Version 4.12 has a feature enhancement in Email Connector. This enhancement extracts the URL string from the email message body and submits it to ATD / IS for analysis.

The ATD / IS Email Connector receives emails with many URL strings in the message body. ATD / IS receives those URL strings and eventually queues the URL samples awaiting scanning.

ATD / IS Email Connector can await the scan results for those URLs. But, the connector times out if the wait time exceeds the Maximum time per email to wait for all scans to complete setting.

Sending MTA (Email Connector, Permitted Host configuration) also treats the SMTP transaction as a timeout. This treatment is because of the excessively long waiting time.

Solution

ATD / IS 4.12.2 and Email Connector installation package version 4.12.2 (systemex 4.12.2) address the issue. Version 4.12.2 provides the User configurable Email connector URL analysis option. Upgrade to version 4.12.2 first, and then install systemex 4.12.2.

If your appliance is running version 4.8 or 4.10 with systemex 4.8.x, and you're planning to migrate ATD / IS to version 4.12, do the following:

Make sure that you migrate to version 4.12.0, and then upgrade to version 4.12.2 and install systemex 4.12.2.
Assess whether you need the URL analysis feature in Email Connector. If you don't need it, disable the URL analysis option after upgrading to version 4.12.2.

If you need the URL analysis feature, do the following:

With ATD 4.12.2 and systemex 4.12.2, closely monitor the sample queue under Analysis, Analysis Status.
If you see many URL samples from atdec in the waiting queue, it means that ATD / IS is running out of scanning capacity due to URL samples from email.
To reduce the queue, add more VM profiles or ATD / IS appliances to your environment.

Workaround

In version 4.12.0, Technical Support can disable the URL analysis option over a remote session by modifying the back-end of your ATD / IS Email Connector.

If you've already upgraded to systemex 4.12.0.7, but aren't ready to upgrade to version 4.12.2, and want to disable URL analysis, contact Technical Support.
Request a remote session and quote this article number.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

ATD / IS receives a large number of URL samples from Email Connector

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

ATD / IS receives a large number of URL samples from Email Connector

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title