About reporting malware-distributing URLs

Microsoft Forefront Threat Management Gateway can automatically report information about malware discovered during malware inspection to the Microsoft Response Center. The reports include the source of the malware, its threat level, and the action that was taken, and they can include traffic samples and complete URLs. The Microsoft Response Center uses this information to help identify emerging attack patterns and Web sites that host infecting files and malware. By default, this reporting is disabled. You can enable it by joining the Microsoft Telemetry Service and selecting your Microsoft Telemetry Service membership type when you run the Getting Started Wizard. You can also modify your Microsoft Telemetry Service membership type on the Join Microsoft Telemetry Service tab of your deployment properties.

When you select Join with a basic membership, the reports about malware discovered during malware inspection include the source of the malware, its threat level, and the action that was taken. When you select Join with an advanced membership, each report also includes a traffic sample and the complete URL requested.