Cisco Cisco Content Security Management Appliance M160 Guia Do Utilizador
4-12
AsyncOS 9.6 for Cisco Content Security Management Appliances User Guide
Chapter 4 Using Centralized Email Security Reporting
Understanding the Email Reporting Pages
How Incoming Mail Messages are Counted
Counts of incoming messages are dependent on the number of recipients per message. For example, an
incoming message from example.com sent to three recipients is counted as three messages coming from
that sender.
incoming message from example.com sent to three recipients is counted as three messages coming from
that sender.
Because the messages blocked by sender reputation filtering do not actually enter the work queue, the
appliance does not have access to the list of recipients for an incoming message. In this case, a multiplier
is used to estimate the number of recipients. This multiplier is based on research of a large sampling of
existing customer data.
appliance does not have access to the list of recipients for an incoming message. In this case, a multiplier
is used to estimate the number of recipients. This multiplier is based on research of a large sampling of
existing customer data.
How Email Messages Are Categorized by the Appliances
As messages proceed through the email pipeline, they can apply to multiple categories. For example, a
message can be marked as spam or virus positive; it can also match a content filter. The precedence of
the various filters and scanning activities greatly impacts the results of message processing.
message can be marked as spam or virus positive; it can also match a content filter. The precedence of
the various filters and scanning activities greatly impacts the results of message processing.
In the example above, the various verdicts follow these rules of precedence:
–
Spam positive
–
Virus positive
–
Matching a content filter
Following these rules, if a message is marked as spam positive, and your anti-spam settings are set to
drop spam positive messages, the message is dropped and the spam counter is incremented.
drop spam positive messages, the message is dropped and the spam counter is incremented.
Further, if your anti-spam settings are set to let the spam positive message continue on in the email
pipeline, and a subsequent content filter drops, bounces, or quarantines the message, the spam count is
still incremented. The content filter count is only incremented if the message is not spam or virus
positive.
pipeline, and a subsequent content filter drops, bounces, or quarantines the message, the spam count is
still incremented. The content filter count is only incremented if the message is not spam or virus
positive.
Alternately, if the message were quarantined by Outbreak Filters, it would not be counted until it was
released from the quarantine and again processed through the work queue.
released from the quarantine and again processed through the work queue.
For complete information about message processing precedence, see chapter about the email pipeline in
the online help or user guide for your Email Security appliance.
the online help or user guide for your Email Security appliance.
Table 4-3
Details on the Email > Reporting > Overview Page
Section
Description
Time Range
A drop-down list with options for choosing a time range to
view. For more information, see the
view. For more information, see the
View Data for
Choose an Email Security appliance for which you want to
view Overview data, or choose All Email Appliances.
view Overview data, or choose All Email Appliances.
See also