Cisco Cisco Content Security Management Appliance M1070 Mode D'Emploi

Some attachments may not be tracked. For performance reasons, scanning of attachment names 
occurs only as part of other scanning operations, for example message or content filtering, DLP, or 
disclaimer stamping. Attachment names are available only for messages that pass through body 
scanning while the attachment is still attached. Some examples when an attachment name will not 
appear include (but are not limited to): 

if the system only uses content filters, and a message is dropped or its attachment is stripped by 
anti-spam or anti-virus filters

if message splintering policies strip the attachment from some messages before body scanning 
occurs. 

Event: Find messages that match specified events, such as messages flagged as virus positive, spam 
positive, or suspected spam, and messages that were delivered, hard bounced, soft bounced, or sent 
to the Virus Outbreak Quarantine. 

Message ID: Find messages by identifying the SMTP “Message-ID:” header or the Cisco IronPort 
message ID (MID). 

Email Security appliance (host): Narrow search criteria to particular Email Security appliances, 
or search across all managed appliances. 

To set up centralized message tracking, complete the following procedures in order: 

On the Security Management appliance, choose Management Appliance > Centralized Services > 
Email> Centralized Message Tracking. 

In the Message Tracking Service section, click Enable. 

If you are enabling centralized email tracking for the first time after running the System Setup Wizard, 
review the end user license agreement, and click Accept.

Submit and commit your changes. 

Verify that Message Tracking is configured and working properly on the Email Security appliance.