Cisco Cisco Email Security Appliance X1050 Betriebsanweisung

Messages released or deleted from a quarantine because of a queue-full condition 
(early expiration only) can optionally have their attachments stripped. This can be 
used to help reduce the chance for virus infected files will be released from a 
quarantine.

Users belonging to the Administrators group have access to quarantines by 
default. Users in the Operators, Guests, Read-Only Operators, and Help Desk 
Users groups can be assigned to a quarantine (so that they may view, process, or 
search messages within a quarantine), but cannot change the quarantine's 
configuration (e.g. the size, retention period, etc.), or create or delete quarantines.

You can create new system quarantines to hold messages. The basic workflow for 
setting up a quarantine is:

Create local users that will interact with the quarantine. A quarantine's user 
list contains local users in all user groups, except Administrators. Users in the 
Administrators group always have full access to the quarantine. For more 
information, see 

. You can also enable your 

IronPort appliance to use an external directory to authenticate users and select 
which user groups have access to the quarantine. For more information, see 

.

Create the quarantine, following the steps below.

Create filters that will move messages to the quarantine. For more 
information about creating filters, see the “Email Security Manager” chapter 
in the Cisco IronPort AsyncOS for Email Configuration Guide and refer to 
“Using Message Filters to Enforce Email Policies” in the Cisco IronPort 
AsyncOS for Email Advanced Configuration Guide.

To create a system quarantine:

Click Add Quarantine on the Quarantines page. The Add Quarantine page is 
displayed.