Why malicious links are being re-written but not getting blocked? Or Why URL Defense is blocking not malicious links?

Please Note That Only An 'Administrator' Level Account Can Report As A False Negative/Positive.

To clarify: 

• False Negative - Emails with bad links not being blocked
• False Positive - Emails with not malicous links getting blocked

Q. How to Report URL Defense FP/FN? 

As the admin, please do the following:

1. Go to Log Search.
2. Search for this message.
3. Click the detail (FN)/View(FP).
4. Press the Report as ... (False Negative /False Positive).
5. Fill out the information on the next page.
6. Submit.
7. Copy the permalink of the message(s) being reported. 
8. Once you do this, create a ticket or reply back to existing indicating you did this and supply the permalinks and link that is having the issue. Please, include in the ticket the link(s) that needs to be blocked or unblocked.

 Q. How long does it take? 

• Because this issues are handled by another team called Spam and Threat Engineering, it can take up to 48 hours.
• Normally they are resolved by the next day.

Q. What about the option: "Report As"? 

If you are using the drop down selection to report as:

• You can only do this one at a time, you cannot mass select messages and report. This does not work.