search for partial URL

Lenny Thaw

3 de março de 2022 00:58

I'd like to be able search for a partial URL.

For example, we might have one email that includes the URL "https://somedomain.com/page1" and another email with URL of "https://somedomain.com/lastpage"

I'd like to be able to search "somedomain.com" or something like that to find those two emails. 

Another example would be to see how many emails used the URL shortener bit.ly  This would be helpful to support a conversation with our CIO and networking team.

As a workaround, I created a rule that adds a tag. I can then search on the tag but when I'm done, I have to delete the rule and then the tag from each matching email (one at a time). That's not sustainable.

Sure hope you can help!

1

• Comentário oficial

  

  Christian Nostrom 7 de março de 2022 16:50

  Hello Lenny,

  Thanks for reaching out to us regarding the "Run Rule Preview" function in PhishER.  You should be able to check the Matched Messages here https://support.knowbe4.com/hc/en-us/articles/360013025854#PREVIEW.  I apologize it runs slow at times and if this continues to be an issue I would recommend you submit a ticket so we can take a closer look into this.  Also if it would be beneficial to set the threshold higer than the last 30 days we would be more than happy to submit a feature request.

  Thanks,

  Christian

  Ações de comentário Permalink
• 

  Scot Perkins 3 de março de 2022 19:51

  We get around this by using the "Run Rule Preview" function as our search engine.   We don't actually apply the rule or enable it, but using the yara engine with a url Regex search is a lot more powerful than the lucene search they give in the inbox tab.

   

   

  0

  Ações de comentário Permalink
• 

  Alex Hutton 3 de março de 2022 19:52

  Hi Lenny,

  We appreciate your submission to the PhishER Feature requests page. Thank you for that suggestion! I've submitted it to our development team for review. We base a lot of our new releases and features on customer ideas and requests, so we do appreciate your input.

  Have a wonderful day!

   

  0

  Ações de comentário Permalink
• 

  Lenny Thaw 4 de março de 2022 17:28

  The "Run Rule Preview" function has a built-in limitation of a maximum of the "Last 30 Days".

  It's also very slow sometimes. I have to take a screenshot of the results to look into those emails and it can then be laborious to find each one.

  Am I approaching PhishER in a peculiar way?

  0

  Ações de comentário Permalink

Por favor, entrar para comentar.