Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
16-7
Cisco AsyncOS 9.0 for Email User Guide
Chapter 16 File Reputation Filtering and File Analysis
Configuring File Reputation and Analysis Features
–
Whether to warn the end user by modifying the message subject, for example, [WARNING:
ATTACHMENT(S) MAY CONTAIN MALWARE].
ATTACHMENT(S) MAY CONTAIN MALWARE].
–
Whether to add a custom header to provide granular controls to the administrator.
•
Select the actions that AsyncOS must perform if an attachment is considered Malicious. Select the
following:
following:
–
Whether to deliver or drop the message.
–
Whether to archive the original message. Archived messages are stored as an mbox-format log
file in the
file in the
amparchive
directory on the appliance. The preconfigured AMP Archive
(
amparchive
) log subscription is required.
–
Whether to deliver the message after removing the malware attachments.
–
Whether to warn the end user by modifying the message subject, for example, [WARNING:
MALWARE DETECTED IN ATTACHMENT(S)].
MALWARE DETECTED IN ATTACHMENT(S)].
–
Whether to add a custom header to provide granular controls to the administrator.
•
Select the actions that AsyncOS must perform if an attachment is sent for File Analysis. Select the
following:
following:
–
Whether to deliver or quarantine the message.
–
Whether to archive the original message. Archived messages are stored as an mbox-format log
file in the
file in the
amparchive
directory on the appliance. The preconfigured AMP Archive
(
amparchive
) log subscription is required.
–
Whether to warn the end user by modifying the message subject, for example, “
[WARNING:
ATTACHMENT(S) MAY CONTAIN MALWARE]
.”
–
Whether to add a custom header to provide granular controls to the administrator.
Step 4
Submit and commit your changes.
Quarantining Messages with Attachments Sent for Analysis
You can configure the appliance to quarantine files sent for analysis instead of releasing them
immediately to the workqueue. Quarantined messages and their attachments are rescanned for threats
upon release from quarantine. If the message is released after file analysis results are available to the
reputation scanner, any identified threats will be caught during rescanning.
immediately to the workqueue. Quarantined messages and their attachments are rescanned for threats
upon release from quarantine. If the message is released after file analysis results are available to the
reputation scanner, any identified threats will be caught during rescanning.
Procedure
Step 1
Select Mail Policies > Incoming Mail Policies.
Step 2
Click the link in the Advanced Malware Protection column of the mail policy to modify.
Step 3
Under Messages with File Analysis Pending section, select Quarantine from the Action Applied to
Message drop-down.
Message drop-down.
The quarantined messages are stored in the File Analysis quarantine. See
Step 4
(Optional) Under Messages with File Analysis Pending section, choose the following options: