Email Spam Quarantine Notification

[RezaFH]

Hi All,

I'm new here. I would like to set up spam quarantine notification on my ESA C395; refer to https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118692-configure-esa-00.html.
my question, I only have two options: send notifications to all users or perform an LDAP query (which my environment does not use).What exactly does the term "all users" mean?, and can we use a content filter to send messages to specific people?

[Ken Stieers]

All users means all users that it has spam in the quarantine for.
What do you use for identity?

I'm pretty sure that mail from the spam quarantine doesn't go through the workqueue, so you can't filter it with Content Filters.

[RezaFH]

Hi Ken,
Thanks for answering. So the term of all users is related to the email address that is sending, and also everyone who is CCed will also receive notifications?

Well, practically, it is not best practice but only solely use RAT for incoming email, so we are not using LDAP Query.

Thanks

[Ken Stieers · Accepted solution]

Not all users who sent mail in (senders), all RECIPIENTS that the ESA has Spam in a Quarantine for... 

So if I send in spam to you and cc your whole IT team, they get a spam copy too, and they'll get a notification of spam in their quarantine. 

What do you use for auth/identity at your company?