URL Categorizer settings for domain submission and HTTPS

This article applies to:

• Trustwave SEG 7.5.0 and above

Question:

• How can I control submission of SEG local domains to the SEG URL Categorizer?
• Can I set the SEG URL Categorization service to use HTTPS?

Information:

SEG 7.5.0 introduces a service that extracts URLs from message bodies and attachments and checks them against a database of known suspect URLs (typically associated with malware or other undesirable behaviors).

The check is performed using the Content Analysis Rule condition Where message contains suspect URLs.

You can perform advanced configuration for this feature using Registry settings.

Local Domain Checking

By default, any URL in the SEG local domains (or subdomains) is not submitted for checking.

To enable checking of URLs in local domains and subdomains:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Add a DWORD value: URLCategorizerNoLocalDomains
4. Set the value data to 0
5. Commit configuration and then restart the Engine service on each processing server.
6. To return to the default behavior, remove this value or set the data to 1.

HTTP or HTTPS Submission

By default, the submission to the remote service uses HTTP (not encrypted) for performance reasons.

To set the categorizer connection to use HTTPS:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Add a DWORD value: URLCategorizerServiceHttps
4. Set the value data to 1.
5. Commit configuration and then restart the Engine service on each processing server.
6. To revert to HTTP, remove this value or set the data to 0.

Note:

As always, take due care when editing the Registry. Trustwave recommends that you make a backup before making any changes.