Cisco Cisco Email Security Appliance X1070 Mode D'Emploi
Chapter 10 Outbreak Filters
10-28
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Because quarantined messages are rescanned whenever new rules are published,
it is very likely that messages in the Outbreak quarantine will be released prior to
the expiration time.
it is very likely that messages in the Outbreak quarantine will be released prior to
the expiration time.
Still, it can be important to monitor the Outbreak quarantine if the Default Action
is set to Delete. Cisco recommends most users to not set the default action to
Delete. For more information about releasing messages from the Outbreak
quarantine, or changing the Default Action for the Outbreak Quarantine, see the
“Quarantines” chapter in the Cisco IronPort AsyncOS for Email Daily
Management Guide.
is set to Delete. Cisco recommends most users to not set the default action to
Delete. For more information about releasing messages from the Outbreak
quarantine, or changing the Default Action for the Outbreak Quarantine, see the
“Quarantines” chapter in the Cisco IronPort AsyncOS for Email Daily
Management Guide.
Conversely, if you have messages in your Outbreak quarantine that you would like
to keep in the quarantine longer while you wait for a new rule update, for example,
you can delay the expiration of those messages. Keep in mind that increasing the
retention time for messages can cause the size of the quarantine to grow.
to keep in the quarantine longer while you wait for a new rule update, for example,
you can delay the expiration of those messages. Keep in mind that increasing the
retention time for messages can cause the size of the quarantine to grow.
Note
If anti-virus scanning is disabled globally (not via a mail policy) while a message
is in the Outbreak quarantine, the message is not anti-virus scanned when it leaves
the quarantine, even if anti-virus scanning is re-enabled prior to the message
leaving the quarantine.
is in the Outbreak quarantine, the message is not anti-virus scanned when it leaves
the quarantine, even if anti-virus scanning is re-enabled prior to the message
leaving the quarantine.
Note
You can use the Outbreak Filters feature without having enabled anti-virus
scanning on the Cisco IronPort appliance. However, Outbreak Filters cannot scan
for non-viral threats if anti-spam scanning is not enabled on the appliance.
scanning on the Cisco IronPort appliance. However, Outbreak Filters cannot scan
for non-viral threats if anti-spam scanning is not enabled on the appliance.
Outbreak Quarantine and the Manage by Rule Summary View
You can view the contents of the Outbreak quarantine by clicking on the name of
the quarantine in the listing on the Monitor menu in the GUI. The Outbreak
quarantine has an additional view as well, the Outbreak Quarantine Manage by
Rule Summary link.
the quarantine in the listing on the Monitor menu in the GUI. The Outbreak
quarantine has an additional view as well, the Outbreak Quarantine Manage by
Rule Summary link.