Configure Link Analysis Exclusions

Overview

Sublime offers two ways to prevent links from being analyzed by Link Analysis.

1. Link Analysis Exclusion Lists: exclude entire subdomains or root domains you know are always safe
2. Link Exclusions: target specific link attributes, such as URL path, when excluding by domain is too broad.

Both options prevent matching links from being sent to Link Analysis and affect Rules that use Link Analysis results. Neither prevents the message itself from being analyzed by all other Rules, Attack Score, or ASA. They also prevent links from being sent to Link Analysis when running Hunts, Backtests, or clicking Link Preview, since these are all surfaces where an unintended click can occur.

---

Link Analysis Exclusion Lists

The link_analysis_excluded_domains and link_analysis_excluded_root_domains Lists allow you to indicate domains and root domains, respectively, on which Link Analysis should not run. This is useful for ensuring that emails your end users receive containing one time use links are not triggered by Link Analysis.

Unlike many other out of the box Lists, these start empty and are intended to be customized based on the vendors you interact with in your email environment.

Setup

Both link_analysis_excluded_domains and link_analysis_excluded_root_domains are string Lists. To configure, simply add your domains and/or root domains to be excluded as List entries.

We recommend applying the most conservative coverage by adding subdomains relevant to your environment under link_analysis_excluded_domains; use link_analysis_excluded_root_domains only when you are sure all links from a given root domain should be excluded. If more precision is needed, use Link Exclusions.

---

Link Exclusions

Link Exclusions offer more precision than Link Analysis Exclusion Lists. They are written in MQL, like other (Exclusions), and are useful when you want to prevent some, but not all, links from a domain being sent to Link Analysis.

Setup

Link Exclusions are created like other Exclusions. To create one:

1. Go to Exclusions > Create and set Scope to Link
2. Name it, add a description (optional), and write the exclusion condition in MQL
3. Click Save
4. Set Status to Active to enable the exclusion

Accessible Fields

The following fields are available when writing a Link Exclusion:

*Note: Excluding a link based on display_text alone is not recommended. Attackers routinely put malicious links behind benign display text (for example: unsubscribe, here, click here, review document). Only use display_text in conjunction with other fields.