SOLVED

How to create rule email to detect html link has in contend email ?

%3CLINGO-SUB%20id%3D%22lingo-sub-358310%22%20slang%3D%22en-US%22%3EHow%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358310%22%20slang%3D%22en-US%22%3E%3CP%3Ehello%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%20%26nbsp%3B%26nbsp%3BI%20want%20quarantine%26nbsp%3Bthese%20has%20link%20email%20in%20content%20please%20help%20me%20define%20rule%20email%20%3F%3C%2FP%3E%3CP%3EBest%20Regards%2C%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-358310%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358967%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358967%22%20slang%3D%22en-US%22%3E%3CP%3EI%20things%20will%20continue%20use%20safe%20link%20and%20monitor%20it%20%2Cthanks%20for%20your%20support%20.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358963%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358963%22%20slang%3D%22en-US%22%3EIf%20you%20block%20all%20the%20emails%20containing%20links%2C%20then%20you'll%20block%20a%20lot%20of%20legitimate%20emails%2C%20so%20I%20don't%20think%20it's%20a%20good%20idea.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358956%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358956%22%20slang%3D%22en-US%22%3E%3CP%3EBut%20when%20i%20just%20receive%20email%20then%20safe%20link%20not%20prevent%20but%20after%20that%20then%20it%20prevent%20.%3C%2FP%3E%3CP%3EThanks%20for%20all%20your%20support%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358947%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358947%22%20slang%3D%22en-US%22%3E%3CP%3EActually%20it%20protects%2C%20as%20you%20can%20see%20in%20the%20picture.%20And%20that's%20the%20beauty%20of%20ATP%2C%20it%20checks%20the%20URL%20each%20time%20a%20user%20clicks%20it.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22%7BEE28A0A2-C50F-4621-8ED6-3A37AFC70685%7D.png.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F84824iED605EBDDD079FEC%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22%7BEE28A0A2-C50F-4621-8ED6-3A37AFC70685%26amp%3B%23125%3B.png.jpg%22%20alt%3D%22%7BEE28A0A2-C50F-4621-8ED6-3A37AFC70685%26amp%3B%23125%3B.png.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358945%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358945%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20getting%20picked%20up%20in%20Edge%20and%20Windows%20Defender%20SmartScreen%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22WebsiteReported.PNG%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F84823iBC35EA2B095CCEE4%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22WebsiteReported.PNG%22%20alt%3D%22WebsiteReported.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20it%20you%20want%20to%20quarantine%20those%20particular%20emails%20without%20ATP%2For%20if%20they%20get%20through%20ATP%20then%20the%20alternative%20is%20to%20use%20a%20Transport%20Rule%20(either%20the%20sender%2FIP)%20to%20go%20to%20quarantine%2C%20or%20put%20them%20on%20the%20Blacklist.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20that%20helps%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBest%2C%20Chris%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358935%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358935%22%20slang%3D%22en-US%22%3E%3CP%3Ebut%20some%20case%20safe%20link%20not%20prevent%20as%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fowanz4i5hc8rowduxwdmjqv.z13.web.core.windows.net%2Findex.php%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fowanz4i5hc8rowduxwdmjqv.z13.web.core.windows.net%2Findex.php%3C%2FA%3E%3C%2FP%3E%3CP%3E.it%20is%20face%20owa%20.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358924%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358924%22%20slang%3D%22en-US%22%3EI%20guess%20you%20are%20afraid%20of%20potentially%20malicious%20URLs%20in%20emails%20or%20office%20documents.%20If%20that's%20the%20case%2C%20I%20think%20the%20best%20protection%20for%20that%20is%20Office%20365%20ATP%20Safe%20Links.%3CBR%20%2F%3E%3CBR%20%2F%3ECheck%20this%20page%20for%20more%20details%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fatp-safe-links%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fatp-safe-links%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358765%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20create%20rule%20email%20to%20detect%20html%20link%20has%20in%20contend%20email%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358765%22%20slang%3D%22en-US%22%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F234118%22%20target%3D%22_blank%22%3E%40Tien%20Ngo%20Thanh%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EWhat%20are%20you%20trying%20to%20do%20here%3F%20Are%20you%20referring%20to%20links%20within%20images%3F%20Or%20are%20you%20referring%20to%20quarantine%20any%20email%20which%20has%20a%20link%20in%20it%3F%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%20Chris%3C%2FLINGO-BODY%3E
Highlighted
Regular Contributor

hello 

    I want quarantine these has link email in content please help me define rule email ?

Best Regards,

Thanks

8 Replies
Highlighted
Hi @Tien Ngo Thanh

What are you trying to do here? Are you referring to links within images? Or are you referring to quarantine any email which has a link in it?

Best, Chris
Highlighted
Best Response confirmed by Tien Ngo Thanh (Regular Contributor)
Solution
I guess you are afraid of potentially malicious URLs in emails or office documents. If that's the case, I think the best protection for that is Office 365 ATP Safe Links.

Check this page for more details:
https://docs.microsoft.com/en-us/office365/securitycompliance/atp-safe-links

Highlighted
Highlighted

This is getting picked up in Edge and Windows Defender SmartScreen

 

WebsiteReported.PNG

 

However, it you want to quarantine those particular emails without ATP/or if they get through ATP then the alternative is to use a Transport Rule (either the sender/IP) to go to quarantine, or put them on the Blacklist. 

 

Hope that helps

 

Best, Chris

Highlighted

Actually it protects, as you can see in the picture. And that's the beauty of ATP, it checks the URL each time a user clicks it.

 

{EE28A0A2-C50F-4621-8ED6-3A37AFC70685}.png.jpg

Highlighted

But when i just receive email then safe link not prevent but after that then it prevent .

Thanks for all your support

Highlighted
If you block all the emails containing links, then you'll block a lot of legitimate emails, so I don't think it's a good idea.
Highlighted

I things will continue use safe link and monitor it ,thanks for your support .