Cisco ESA, BCC all incoming and outgoing emails

[jonathan_magay]

Good Day Everyone,

I'm new to Cisco ESA, Just want to ask a question for Silent BCC or Always CC. Silent BCC is a way to BCC every outgoing/incoming emails to  two or many administrator's email from the company users email without senders notice. Always CC is to CC outgoing/incoming emails to two or administrator's email with senders notice.

The purpose is to easily monitor any incoming, outgoing and backup also all the emails in redundant way. Is it possible to make this feature to Cisco ESA?

Any suggestions and ideas commented is highly appreciated. thanks in advance.

[exMSW4319 · Accepted solution]

If you're just starting then a content rule is probably best:

Incoming-Trace: if (rcpt-to == "@your-domain$") { bcc ("archive@your-domain", "$subject"); }

archive@your-domain is your internal mailbox you want to archive the mail to.

[Michael Gioia]

Is this still the case in AsyncOS 10.0 ?

Will all other engines (AV, etc) get evoked still and this 'content rule' will be processed last in the workflow ? That's the goal for me anyhow... I need to not evoke a 'BCC ALL', but logic comprising of,

// 'if email is cleaned with existing engines/signatures, then evoke BCC' //

[Paul Cardelli]

Also you may want to just CC to a Policy Quarantine or a shared mailbox. One issue I found with silent CC/BCC. Is that they are only as silent as when you don't have an Out of Office Notification turned on. "True Story"

Also best practice internally is to setup Email Archiving with a journaling mailbox. This will accomplish what you needs, then just give access to the archive. Less storage, and impact on your system. More scalable.