Cisco Cisco Email Security Appliance C370D User Guide

Messages released from the Outbreak quarantine are run through the anti-virus 
filter again. If it is now marked as a known virus, then it will be subject to your 
anti-virus settings (including a possible second quarantining in the Virus 
quarantine). For more information, see 

.

Thus it is important to note that in a message's lifetime, it may actually be 
quarantined twice — once due to the Virus Outbreak Filters feature, and once 
when it is released from the Outbreak quarantine. A message will not be subject 
to a second quarantine if the anti-virus verdicts from each anti-virus scan (prior 
to Virus Outbreak Filters, and when released from the Outbreak quarantine) 
match. Also note that the Virus Outbreak Filters feature does not take any final 
actions on messages. The Virus Outbreak Filters feature will either quarantine a 
message (for further anti-virus processing) or move the message along to the next 
step in the pipeline.

If your appliance uses either IronPort Anti-Spam or Intelligent Multi-Scan, 
messages released from the Outbreak quarantine are also run through the 
anti-spam filter based on the mail flow policy that applies to the message. If it is 
detected as spam, suspect spam, or marketing, the message will be subject to your 
anti-spam settings, including quarantining in the IronPort Spam Quarantine. For 
more information on how anti-spam filtering works, see