ESA – Outbreak Filter – different Threat Disclaimers for type “Phish” and “Virus”?

[xgadmagar]

Currently I am using Outbreak Filter (ESA 8.5.7) with the general configuration for adding a Threat Disclaimer.

Is it possible to have a different configuration for phishing mail?

The special threat disclaimer for phishing mails should only add with thread level 4 or 5.

In addition I like to use a different disclaimer text for phishing and virus mails.

In the UI I did not find any way to configure that. In addition I did not find any hints in the AsyncOS E-Mail User Guide.

Is there a way to write custom rules for that?

current configuration (Mail Policies: Outbreak Filters):

Message Modification Threat Level: 3

Message Subject:           none

Include the X-IronPort-Outbreak-Status headers: Enable for all messages

Include the X-IronPort-Outbreak-Description header: Enable

URL Rewriting: Disable

Threat Disclaimer:           [custom_disclaimer; Mail Policies > Text Resources > Disclaimers ]

[Mathew Huynh]

Hello,

The message modification to add the disclaimer will take action based on the URLs within the email;

---

Enable message modification. Required for non-viral threat detection (excluding attachments)

---

So viral threats will be taken as a quarantined action, while message modification handles other threats that's not related to the attachment file.

Regards,

Matthew