URL Protection

Ok think i understand.

So you mean urls in the message text can so be identified and the mail can than be moved to quarantine? That would be great. If yes, is this possible with embedded images in mails, wich have attached a clickable link to a url too? Because we have seen many mails with that new attack surface. The sophos support told us to report these mails as spam for further analyses. But this is not the best solution in that case, because over time we now about the bad url's so we want to handle them.

Can you tel me how such a REGEX for that specific case und the product sophos email protection should look like?

Tanks in advance.

Try to start with a normal URL. If it is a HTML email, then the Central should find the URL as well. 

Double Check here the Attachment Content is selected on the bottom. 

Ok i see. So i have testet both situations now (only link and link attached to embedded picuture) both are then in our example configuration then quarantined in sophos email protection. Thats the solution we have searched for.

I tested it again. It is not realy well working. Sometimes it filters / sometimes not.

Can you analyze the both emails and compare them to each other, when it does not work? 

Can you analyze the both emails and compare them to each other, when it does not work?