Email Help

[mwardale777]

Looking for some help please.

I have a customer who is using C170 ESA and recently we had a mail with malicious content that usual is blocked, but got through.

Then I sent the mail myself from a test account with the same content and it was correctly blocked by the ESA

I have also seen two identical mails from the tracker... from different senders but both originating from Outlook, one was blocked and one was allowed.

Please see details attached, any direction to give an answer to my end user would be appreciated. 

Thank you all

[munbali]

Hi  mwardale777,

i can see that for the second email it was detected by the anti-spam engine after 5 days from the original email that went through, so it is highly possible that the rules were updated to detect this email after this time as the  engine’s detection content is always updated and new rules are published multiple times a day.

in the future , if you do encounter a missed spam email, you can feel free to submit it for investigation to the address spam@access.ironport.com

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117822-qanda-esa-00.html

Best Regards,

Muna Bali

[mwardale777]

Hi,

Make's sense. 

Thanks for your quick reply.