Cisco Cisco Content Security Management Appliance M390
R E P O R T I N G G L O S S A R Y
C H A P T E R 1 : R E P O R T I N G A P I
5
R E P O R T I N G G L O S S A R Y
This section defines some commonly used terms and phrases in the Email Security Monitor
reporting pages. Please refer to the product documentation for more details.
reporting pages. Please refer to the product documentation for more details.
Messages
Email Security Monitor reports on “messages” based on the number of recipients per email.
For example, an incoming message from example.com sent to three recipients would count as
three messages coming from that sender.
For example, an incoming message from example.com sent to three recipients would count as
three messages coming from that sender.
Domains
Email Security Monitor rolls up statistics for IP addresses and hostnames to entities called
domains, which are determined by a list of top level domains (TLD) and second level domains
(SLD) provided by IronPort. For example, reporting data for mx1.ironport.com and
mx2.ironport.com will be reported under ironport.com because “com” is a TLD. Some
domains such as co.uk and fed.us are handled as special cases because these SLDs contain
large networks. In such cases, IronPort will report on the domain that is one level lower in the
hostname. Most exports stream their data back to the client because the amount of data is
potentially very large. Please contact IronPort Customer Support if you need to add custom
second level domains to your IronPort appliances.
domains, which are determined by a list of top level domains (TLD) and second level domains
(SLD) provided by IronPort. For example, reporting data for mx1.ironport.com and
mx2.ironport.com will be reported under ironport.com because “com” is a TLD. Some
domains such as co.uk and fed.us are handled as special cases because these SLDs contain
large networks. In such cases, IronPort will report on the domain that is one level lower in the
hostname. Most exports stream their data back to the client because the amount of data is
potentially very large. Please contact IronPort Customer Support if you need to add custom
second level domains to your IronPort appliances.
Outgoing Mail
Email Security Monitor counts a message as “outgoing” if it matches and is processed under a
RELAY policy.
RELAY policy.
Internal User
For incoming mail, Internal Users are the users for which your IronPort appliance received
email, based on the Rcpt To: address. For outgoing mail, Internal Users are based on the Mail
From: address and are useful when tracking the types of email that senders on your internal
network are sending.
email, based on the Rcpt To: address. For outgoing mail, Internal Users are based on the Mail
From: address and are useful when tracking the types of email that senders on your internal
network are sending.
Reputation Filtering ‘Multiplier’
Because messages blocked by reputation filtering do not actually enter the work queue, the
appliance does not have access to the list of recipients for an incoming message. In this case,
a multiplier is used to estimate the number of recipients. This multiplier was determined by
IronPort Systems, Inc. and based upon research of a large sampling of existing customer data.
Please contact IronPort Customer Support if you need to change the value of this multiplier.
appliance does not have access to the list of recipients for an incoming message. In this case,
a multiplier is used to estimate the number of recipients. This multiplier was determined by
IronPort Systems, Inc. and based upon research of a large sampling of existing customer data.
Please contact IronPort Customer Support if you need to change the value of this multiplier.