Cisco Cisco Email Security Appliance C190 Guía Del Usuario
10-31
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Chapter 10 Outbreak Filters
SNMP traps are generated when a rule update fails. For more information about
SNMP traps in AsyncOS, see the “Managing and Monitoring via the CLI” chapter
in the Cisco IronPort AsyncOS for Email Daily Management Guide.
SNMP traps in AsyncOS, see the “Managing and Monitoring via the CLI” chapter
in the Cisco IronPort AsyncOS for Email Daily Management Guide.
AsyncOS has two types of alerts for the Outbreak Filter feature: size and rule
AsyncOS alerts are generated whenever the Outbreak quarantine’s size goes
above 5, 50, 75, and 95 of the maximum size. The alert generated for the 95%
threshold has a severity of CRITICAL, while the remaining alert thresholds are
WARNING. Alerts are generated when the threshold is crossed as the quarantine
size increases. Alerts are not generated when thresholds are crossed as the
quarantine size decreases. For more information about alerts, see
above 5, 50, 75, and 95 of the maximum size. The alert generated for the 95%
threshold has a severity of CRITICAL, while the remaining alert thresholds are
WARNING. Alerts are generated when the threshold is crossed as the quarantine
size increases. Alerts are not generated when thresholds are crossed as the
quarantine size decreases. For more information about alerts, see
AsyncOS also generates alerts when rules are published, the threshold changes,
or when a problem occurs while updating rules or the CASE engine.
or when a problem occurs while updating rules or the CASE engine.
Troubleshooting The Outbreak Filters Feature
This section provides some basic troubleshooting tips for the Outbreak Filters
feature.
feature.
Use the checkbox on the Manage Quarantine page for the Outbreak quarantine to
notify Cisco of mis-classifications.
notify Cisco of mis-classifications.
Multiple Attachments and Bypassed Filetypes
Bypassed file types are only excluded if a message’s only attachment is of that
type, or in the case of multiple attachments, if the other attachments do not yet
have existing rules. Otherwise the message is scanned.
type, or in the case of multiple attachments, if the other attachments do not yet
have existing rules. Otherwise the message is scanned.
Message and Content Filters and the Email Pipeline
Message and content filters are applied to messages prior to scanning by Outbreak
Filters. Filters can cause messages to skip or bypass the Outbreak Filters
scanning.
Filters. Filters can cause messages to skip or bypass the Outbreak Filters
scanning.