Cisco Cisco Email Security Appliance C690 User Guide

An IronPort Spam quarantine is a special kind of quarantine used to hold spam or 
suspected spam messages for end users. End users are mail users, outside of 
AsyncOS. You can have a local IronPort Spam quarantine, stored on the Cisco 
IronPort appliance. You can also send messages to an external IronPort Spam 
quarantine, stored on a separate Cisco IronPort appliance. IronPort Spam 
quarantines can be accessed by both AsyncOS administrators and end users (these 
are not AsyncOS users).

A system quarantine (unchanged from previous versions) is used to hold messages 
based on various actions performed by AsyncOS, such as filtering, anti-virus 
scanning, and Outbreak Filters.

Typically, messages are placed in system quarantines due to a filter action. 
Additionally, the Outbreak Filters feature quarantines suspicious messages in the 
Outbreak quarantine, specifically. System quarantines are configured to process 
messages automatically—messages are either delivered or deleted based on the 
configuration settings (for more information, see 

) set for the quarantine(s) in which the message is placed. In addition to 

the automated process, designated users (such as your mail administrator, Human 
Resources personnel, Legal department, etc.) can review the contents of the 
quarantines and then either release, delete, or send a copy of each message. 
Released messages are scanned for viruses (assuming that anti-virus is enabled 
for that particular mail policy). 

System Quarantines are ideal for: 

Policy Enforcement - have Human Resources or the Legal department review 
messages that contain offensive or confidential information before delivering 
them.

Virus quarantine - store messages marked as not scannable (or encrypted, 
infected, etc.) by the anti-virus scanning engine.