cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
973
Views
5
Helpful
3
Replies

Get RemoteIP of email addresses with MIDs categorized as SPAM

Angel Estevez
Level 1
Level 1

Hi,

I have an IronPort C670 working with AsyncOS 9.7 and I need to get the IP address of the remote clients with MIDs categorized as SPAM. How can I do this?

I know it's possible to create a message filter applied to the Mail Log including the $RemoteIP, but I don't know how to apply it for every spammer.

Could anyone help me? Maybe there are different ways to accomplish this task, but after reading the User Guide I can't figure out how to perform them.

Thanks in advance.

3 Replies 3

dmccabej
Cisco Employee
Cisco Employee

Hello,

This can be done by modifying the Anti-Spam settings on your mail policy. Under Advanced you have the option to add a header and can use the $RemoteIP variable.

Also, you can use the following article to test these settings : ESA FAQ: How can I test the ESA Anti-Spam feature?

Hope that helps! :)

Thanks!

-Dennis M.

____________________________

Works like a charm! Thank you so much!

You're very welcome! :) Glad I could help!

-Dennis M.