Cisco Cisco Content Security Management Appliance M1070 Mode D'Emploi

Use reports on this page to: 

Identify attacks involving a large number of messages from a single sender, or with identical 
subjects, within a moving one-hour period. 

Monitor top domains to ensure that such attacks do not originate in your own domain. If this 
situation occurs, one or more accounts in your organization may be compromised. 

Help identify false positives so you can adjust your filters accordingly. 

Reports on this page show data only from message filters that use the Header Repeats rule and that pass 
the number-of-messages threshold that you set in that rule. When combined with other rules, the Header 
Repeats rule is evaluated last, and is not evaluated at all if the message disposition is determined by a 
preceding condition. Similarly, messages caught by Rate Limiting never reach Header Repeats message 
filters. Therefore, some messages that might otherwise be considered high-volume mail may not be 
included in these reports. If you have configured your filters to whitelist certain messages, those 
messages are also excluded from these reports. 

For more information about message filters and the Header Repeats rule, see the online help or user 
guide for your Email Security appliance. 

The Email > Reporting > Content Filters page shows information about the top incoming and outgoing 
content filter matches (which content filter had the most matching messages). The page displays the data 
as both bar charts and listings. Using the Content Filters page, you can review your corporate policies 
on a per-content-filter or per-user basis and answer the following types of questions:

Which content filter is triggered the most by incoming or outgoing mail?

Who are the top users sending or receiving mail that triggers a particular content filter?

To view more information about a specific filter, click the name of the filter. The Content Filter Details 
page appears. For more information on Content Filter details page, see the 

If your access privileges allow you to view Message Tracking data: To view Message Tracking details 
for the messages that populate this report, click a blue number link in the table. 

From the Content Filters page you can also generate a PDF or export raw data to a CSV file. For 
information on printing or exporting a file, see the 

.

You can generate a scheduled report for the Content Filter page. See the 

The Content Filter Detail page displays matches for the filter over time, as well as matches by internal 
user.