ESA License expired issue

[joselin]

Dear team, 

We have implemented a CISCO ESA 300, unfortunately the license expired and didnt receive any alert messages. The box accepted mails with out any security until we applied new licenses after 12 hours. nearly around 1.5 lakh's mail was received. 

Now is there any ways to identify any of the mails received during this 12 hours is malicious or not. Any possible ways to identify and get a report on the same. 

Regards

Joslee

[Ken Stieers]

There's not really any way to do what you're looking for.

The ESA didn't keep the mail, so it can't scan it, and it won't go back to scan the logs to tell you "oh, this ip is one we'd have blocked..."