Email feature extraction

Email feature extraction allows the Email Security - Server appliance to scan the header and parts of the message body, and then extract the email features such as the sender address, sender domain, number of recipients, number of URLs, number of attachments, domain of the URL, and the original name of an attachment. Based on these features, the appliance determines whether the email should be submitted for further analysis to the Trellix Advanced URL Detection Engine (FAUDE), email YARA analysis, or static analysis. The features in the email can help to detect malware.