Skip to main content

Trellix: CORRECTION - Advanced URL Detection Naming Architecture Changes

Updated

We want to inform you of an architecture change that will impact the Advanced URL Detection Engine (FAUDE) for the following products on the following date:

  • Implementation: October 20, 2026 – 23:00–01:00 UTC
  • Impacted Products: Email Security - Cloud (ETP), Email Security - Server (EX), File Protect (FX), Intelligent Virtual Execution (Server and Cloud), Malware Analysis (AX), and Network Security (NX).

FAUDE protects enterprise email environments by emulating, inspecting, and detonating inbound URLs. The previous naming convention was opaque and did not quickly enable analysis. The transition from generic legacy alerts to the flat mechanism naming scheme was driven by key operational, analytical, and engineering objectives:

  1. Elimination of Opaque Verdicts: Legacy generic names such as Phish.LIVE.DTI.URL and Malicious.LIVE.DTI.URL indicated what general class was blocked but obscured how the engine reached that conclusion. The updated naming exposes the specific inspection module directly in the alert name.
  2. Deterministic SIEM Normalization: A standardized three-part token syntax ensures predictable, regex-based log parsing across all downstream SIEM, SOAR, and data lake pipelines.

For more information, please review the following article:

Powered by Zendesk