This article applies to:
- Trustwave MailMarshal (SEG)/Trustwave SEG 6.7 and above
- Blended Threats Module
Question:
- How does the MailMarshal Blended Threats Module work?
- What are the requirements for the Blended Threats Module?
- Can I disable Blended Threats Module updates?
Information:
Blended Threats are security threats to a network delivered using multiple vectors. For instance, a malicious URL delivered by email, with text that encourages the recipient to click the link, is a Blended Threat attack.
The Blended Threats Module in MailMarshal SMTP/Trustwave SEG provides zero day protection against Blended Threats.
This module is an optional feature licensed separately.
Version 7.1 and above
In MailMarshal SEG 7.1 and above, Blended Threat analysis is implemented by rewriting web URLs found in email messages. There is no local database of URLs.
When a user clicks a rewritten URL, the URL is submitted and scanned in real time by the Blended Threat Service. To rewrite URLs, use the Rule Action "Rewrite URLs in the message for Blended Threat Scanning."
- The URL of the scanner accessed by the email clients is: http://scanmail.trustwave.com/
- Click statistics are retrieved by the Array Manager from: https://stats.scanmail.trustwave.com/
- For more details of the functionality in this version, see Trustwave Knowledge Base article Q14548.
- Licensing of this module also requires web access. For more information see Trustwave Knowledge Base article Q12992.
Additional information is available in the FAQ document attached to this article.
Version 7.0 and below
The Blended Threat check is implemented as a Standard Rule condition. When a message is processed using this condition:
- The module extracts any URLs from the body of each email message.
- Each URL is checked against a local database of known threats and safe URLs.
- If a URL is not in the local database, it is submitted to the Trustwave Blended Threat server for analysis. You can choose to hold email that contains unknown URLs to wait for a database update, and retry the condition later.
The local database of URLs is updated from the Blended Threat server every three minutes by default.
The Blended Threats Module database updates are performed by the MailMarshal Engine service on each email processing node server. For the Blended Threats Module to function correctly, this service must be able to access the update server at:
- http://btmupdates.marshal.com
- https://btmupdates.marshal.com
You can configure a proxy setting for this service using the Internet Access item in MailMarshal Properties or Server Properties. For more information about configuring the proxy, see Help.
To disable the updates, simply do not use the Blended Threats rule condition in any enabled rules.