Cisco Cisco Email Security Appliance C170 사용자 가이드
10-17
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
OL-25136-01
Chapter 10 Outbreak Filters
Note
The Email Security appliance may rewrite URLs in a DomainKeys/DKIM-signed message and
invalidate the message’s signature if a server or appliance on your network other than the Email
Security appliance is responsible for verifying the DomainKeys/DKIM signature.
invalidate the message’s signature if a server or appliance on your network other than the Email
Security appliance is responsible for verifying the DomainKeys/DKIM signature.
•
Enable for all messages. This option allows AsyncOS to rewrite URLs in all messages that meet or
exceed the message modification threshold, including signed ones. If AsyncOS modifies a signed
message, the signature becomes invalid.
exceed the message modification threshold, including signed ones. If AsyncOS modifies a signed
message, the signature becomes invalid.
•
Disable. This option disables URL rewriting for Outbreak Filters.
You can modify a policy to exclude URLs to certain domains from modification. To bypass domains,
enter the IPv4 address, IPv6 address, CIDR range, hostname, partial hostname or domain in the Bypass
Domain Scanning field. Separate multiple entries using commas.
enter the IPv4 address, IPv6 address, CIDR range, hostname, partial hostname or domain in the Bypass
Domain Scanning field. Separate multiple entries using commas.
Threat Disclaimer
The Email Security appliance can append a disclaimer message above the heading of a suspicious
message to warn the user of its content. This disclaimer can be in HTML or plain text, depending on the
type of message.
message to warn the user of its content. This disclaimer can be in HTML or plain text, depending on the
type of message.
Select the disclaimer text you want to use from the Threat Disclaimer list or click the Mail Policies >
Text Resources link to create a new disclaimer using the Disclaimer Template. The Disclaimer Template
includes variables for outbreak threat information. You can see a preview of the threat disclaimer by
clicking Preview Disclaimer. For custom disclaimer messages, you can use variables to display the threat
level, the type of threat, and a description of the threat in the message. For information on creating a
disclaimer message, see
Text Resources link to create a new disclaimer using the Disclaimer Template. The Disclaimer Template
includes variables for outbreak threat information. You can see a preview of the threat disclaimer by
clicking Preview Disclaimer. For custom disclaimer messages, you can use variables to display the threat
level, the type of threat, and a description of the threat in the message. For information on creating a
disclaimer message, see
The Outbreak Filters Feature and the Outbreak Quarantine
Messages quarantined by the Outbreak Filters feature are sent to the Outbreak quarantine. This
quarantine functions like any other quarantine (for more information about working with quarantines,
see the “Quarantines” chapter in the Cisco IronPort AsyncOS for Email Daily Management Guide)
except that it has a “summary” view, useful for deleting or releasing all messages from the quarantine,
based on the rule used to place the message in the quarantine (for Outbreak Rules, the Outbreak ID is
shown, and for Adaptive Rules, a generic term is shown). For more information about the summary view,
see
quarantine functions like any other quarantine (for more information about working with quarantines,
see the “Quarantines” chapter in the Cisco IronPort AsyncOS for Email Daily Management Guide)
except that it has a “summary” view, useful for deleting or releasing all messages from the quarantine,
based on the rule used to place the message in the quarantine (for Outbreak Rules, the Outbreak ID is
shown, and for Adaptive Rules, a generic term is shown). For more information about the summary view,
see