Cisco Email Submission and Tracking Portal

[mewi]

Two weeks ago I have sent some HAM-emails to the portal.
I can see 8 Actionable Submissions
But since 2 weeks I don´t see any status changes.
What is happening with these emails?
The Status ist always the same. "8 Number of Actionable Submissions"

How do I see if Cisco is analyzing the emails?

Regards

[Libin Varghese]

Hi,

Below is a walk through on using the spam submission portal.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200648-ESA-FAQ-How-to-work-with-Cisco-Email-Su.html

As mentioned, submission samples determined to be actionable are combined together with actionable samples from other customers, real time data from global sensors, human intelligence, device telemetry and external/partner data feeds.

All of this feeds into multiple automated and Machine Learning systems and technologies that are analyzing this data 24x7 to create new probabilities and weighting for tens to hundreds of thousands of email features used in IronPort Anti-Spam (IPAS) detection content that is then consumed by email security devices.

So you would not see a change in the status, the actionable status just confirms that the sample submitted was in the correct format and it would be used to update detection content.

The portal is not at an interaction level where it will show a change in a missed spam or ham message.

Regards,

Libin Varghese

[mewi]

Hi,
Thanks for your answer.
I think it would be very helpful when Cisco could give Feedback about the HAM I´ve sent to the portal.
I want to know if they will be implemented it in IPAS or not.
Now I have extra rules to allow the good emails which are detected as false positives.
It would be very nice to know, if and when my examples are implemented in IPAS.

Regards,
Meinrad