Trustifi’s URL Hunting tool allows security teams to track and identify users who clicked on scanned links, and provide additional details like the specific location and browser/device that was used when the link was clicked
Enabling URL Hunting
To enable this feature, scroll down to the bottom of the “Configuration” tab in the “Inbound Shield” page and click on the toggle in the “URL Hunting” section.
Note: URL Hunting can only be enabled if “On-click scan” is enabled as well.
Viewing link click events
Navigate to the “URL Hunting” page under “Inbound Management”, or go directly to this URL – https://app.trustifi.com/inbound/urlTracking .
By default, the page will display all of the recent clicked links when clicking on the “Get” button.
If you want to find a specific link, or create a more elaborate search, you can build a query by clicking on the query builder icon:
Here you can enter a specific URL, or search for all links from a certain domain.
You may also add more information such as the email’s sender, recipient mailbox, email subject, or Message-ID.
After you’ve build your query, you can click on “Get” to find only the link-click events that match your search.
The results display individual events of links being clicked. This means that if the same link was clicked by multiple recipients, or even by the same recipient multiple times, the page will display each time the link was clicked.
For each link-click event, you can see the following information:
- Date and time the link was clicked
- The URL of the link that was clicked
- The recipient/user who clicked on the link
- The device/browser and location from which the link was clicked
- Subject of the email containing the link
- Sender of the email
Performing actions
From the “Actions” menu, you can perform several actions on the email containing the link or on the sender of the email:
- Show content: displays the content of the email containing this link
- Blocklist link: will add the URL to your global links blocklist
- Blocklist link: will add the sender of the email to your global senders blocklist
- Safe preview: generates a safe, sandboxed view of the URL. Can be used to determine if the link is dangerous without the risk of malware or phishing.
- Remove email: deletes the email from the recipient’s mailbox.
Note: this feature only works if you have an API integration between Trustifi and your O365 or Google mail server.