Disabling rewriting of subject lines for Blended Threat analysis

This article applies to:

• Trustwave SEG 7.2.3 and above
• Blended Threats functionality

Question:

• How can I avoid rewriting of subject lines by the Blended Threat function? 

Comments:

By default the Blended Threat function rewrites URLs that are found in message subjects. This behavior is by design to ensure security, because some email client software renders clickable links in the subject.

Users may find that the rewritten subjects are difficult to read.

Procedure:

To disable rewriting of URLs in subjects:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Create a new value data entry as follows:
   • Data Type: DWORD (integer)
   • Value Name: BTMRewriteURLInSubject
   • Value: 0
4. From the Configurator, Commit Configuration Changes to push the update to the node(s).

Notes:

• To revert to the default behavior, set the value to 1 (or delete the value entry).
• As best practice, back up the registry before making changes.