Cisco Cisco Email Security Appliance C650 Guía Del Usuario
16-7
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 16 File Reputation Filtering and File Analysis
Configuring File Reputation and Analysis Features
–
Whether to deliver or drop the message.
–
Whether to archive the original message. Archived messages are stored as an mbox-format log
file in the
file in the
amparchive
directory on the appliance. The preconfigured AMP Archive
(
amparchive
) log subscription is required.
–
Whether to deliver the message after removing the malware attachments.
–
Whether to warn the end user by modifying the message subject, for example, [WARNING:
MALWARE DETECTED IN ATTACHMENT(S)].
MALWARE DETECTED IN ATTACHMENT(S)].
–
Whether to add a custom header to provide granular controls to the administrator.
•
Select the actions that AsyncOS must perform if an attachment is sent for File Analysis. Select the
following:
following:
–
Whether to deliver or quarantine the message.
–
Whether to archive the original message. Archived messages are stored as an mbox-format log
file in the
file in the
amparchive
directory on the appliance. The preconfigured AMP Archive
(
amparchive
) log subscription is required.
–
Whether to warn the end user by modifying the message subject, for example, “
[WARNING:
ATTACHMENT(S) MAY CONTAIN MALWARE]
.”
–
Whether to add a custom header to provide granular controls to the administrator.
Step 4
Submit and commit your changes.
Quarantining Messages with Attachments Sent for Analysis
You can configure the appliance to quarantine files sent for analysis instead of releasing them
immediately to the workqueue. Quarantined messages and their attachments are rescanned for threats
upon release from quarantine. If the message is released after file analysis results are available to the
reputation scanner, any identified threats will be caught during rescanning.
immediately to the workqueue. Quarantined messages and their attachments are rescanned for threats
upon release from quarantine. If the message is released after file analysis results are available to the
reputation scanner, any identified threats will be caught during rescanning.
Procedure
Step 1
Select Mail Policies > Incoming Mail Policies.
Step 2
Click the link in the Advanced Malware Protection column of the mail policy to modify.
Step 3
Under Messages with File Analysis Pending section, select Quarantine from the Action Applied to
Message drop-down.
Message drop-down.
The quarantined messages are stored in the File Analysis quarantine. See
Step 4
(Optional) Under Messages with File Analysis Pending section, choose the following options: