Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Página de 652
10-11
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Chapter 10      Outbreak Filters
Threat Levels
 provides a basic set of guidelines or definitions for each 
of the various levels.
For more information about threat levels and outbreak rules, see 
Guidelines for Setting Your Quarantine Threat Level Threshold
The quarantine threat level threshold allows administrators to be more or less 
aggressive in quarantining suspicious messages. A low setting (1 or 2) is more 
aggressive and will quarantine more messages; conversely, a higher score (4 or 5) 
is less aggressive and will only quarantine messages with an extremely high 
likelihood of being malicious.
The same threshold applies to both virus outbreaks and non-virus threats, but you 
can specify different quarantine retention times for virus attacks and other threats. 
See 
 for more information.
Cisco recommends the default value of 3.
Table 10-1
Threat Level Definitions 
Level
Risk
Meaning
0
None
There is no risk that the message is a threat.
1
Low
The risk that the message is a threat is low.
2
Low/Medium The risk that the message is a threat is low to medium. 
It is a “suspected” threat.
3
Medium
Either the message is part of a confirmed outbreak or 
there is a medium to large risk of its content being a 
threat.
4
High
Either the message is confirmed to be part of a large 
scale outbreak or its content is very dangerous.
5
Extreme
The message’s content is confirmed to part of an 
outbreak that is either extremely large scale or large 
scale and extremely dangerous.