Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Evaluation of file reputation and sending of files for analysis occur immediately after anti-virus 
scanning, regardless of verdicts from previous scanning engines, unless a final action has been taken on 
the message. 

Communications between the appliance and the file reputation service are encrypted and protected 
from tampering. 

After a file’s reputation is evaluated: 

If the file is known to the file reputation service and is determined to be clean, the message continues 
through the workqueue. 

If the file reputation service returns a verdict of malicious for any attachment in the message, then 
the appliance applies the action that you have specified in the applicable mail policy. 

If the file is known to the reputation service but there is insufficient information for a definitive 
verdict, the reputation service returns a reputation score based on characteristics of the file such as 
threat fingerprint and behavioral analysis. If this score meets or exceeds the configured reputation 
threshold, the appliance applies the action that you have configured in the mail policy for files that 
contain malware. 

If the reputation service has no information about the file, and the file does not meet the criteria for 
analysis (see 

), the file is considered clean and 

the message continues through the workqueue. 

If you have enabled the File Analysis service, and the reputation service has no information about 
the file, and the file meets the criteria for files that can be analyzed (see 

), then the message can be quarantined (see 

) and the file sent for analysis. If you have not configured 

the appliance to quarantine messages when attachments are sent for analysis, or the file is not sent 
for analysis, then the message is released to the user. 

For deployments with on-premises file analysis, the reputation evaluation and file analysis occur 
simultaneously. If the reputation service returns a verdict, that verdict is used, as the reputation 
service includes inputs from a wider range of sources.  If the file is unknown to the reputation 
service, the file analysis verdict is used. 

If file reputation or file analysis verdict information is unavailable because the connection with the 
service timed out, the file is considered clean and is released to the end user. If the verdict is 
unscannable for any other reason, the appliance applies the action that you have specified for 
unscannable attachments in the applicable mail policy.