Bypass ESA AMP for Sender

[Greg Hopp]

I have a phishing training vendor who wants to send us email with file attachments.  The attachments contain VB code that makes my Ironport's AMP service think they are malicious.  The attachments get uploaded to a sandbox for analysis, test positive for malware, and the Ironport dutifully deletes them from the AMP quarantine.

Is there  a way to whitelist a particular sender so file attachments are not uploaded to Talos for AMP inspection?

[Libin Varghese · Accepted solution]

To bypass amp scanning for a particular sender you could either add a message filter from the CLI with action skip-ampcheck() ; or create a separate incoming mail policy from the WebUI with the sender as a member and turn off amp scanning for that particular incoming mail policy.

Regards 

Libin Varghese 

[Greg Hopp · Accepted solution]

Libin,

That did the trick, thanks.  I was focused on Content Filters and sorta forgot about creating a new policy.  My solution was to create a policy that skips ALL scans: anti-Spam, anti-Virus, AMP, Graymail, Content & Outbreak filters in order to allow the email with the attachment through.

That's not exactly a desirable policy to apply to everyone, so I narrowed the policy down to just the sender domains the phishing email would be coming from by clicking "Following Senders" and entering in the domains separated by commas.  That seems to work great.  Our phish tests for employees have resumed!

[Libin Varghese]

Glad to hear its working as per your requirement.

- Libin V