Hide Message Bodies to Security Administrators

[caetano.baiao]

Hi guys,

We have a couple of C370 ESAs at our company and just recently implemented End-User Quarantine Access and also some quarantine based on Content Filters.  Due to the fact that our team still has to manage the quarantine for some of our top board members, we need to ensure that the message bodies are not accessible to our appliance administrator or at least that we are notified if anybody accesses any of the message bodies.

Any help would be greatly appreciated.

[Libin Varghese · Accepted solution]

Hi Caetano,

Currently this is not a modifiable option, The message body of the messages in the quarantine will be shown and a notification cannot be generated based on that.

I do see an internal feature request already created for this ability to be added, however there is no ETA on the same.

Thanks

Libin Varghese

[caetano.baiao]

Thank you very much for your prompt reply, Libin.  Really appreciate it.

[caetano.baiao]

Hi Libin,

Just another quick question:

Are there any logs generated related to the access to message bodies?  Not notifications, but something that an audit team could look at at a later time?

Thanks,

Caetano

[Libin Varghese]

Caetano,

Although there are no logs to look for that specifically, however euq_logs and euqgui_logs (for spam quarantine) and gui_logs (for other quarantines) do track all activities.

Note: these logs are not very human readable friendly - as such TAC does not generally audit these logs due to the volume and broadness of the log.

You could see what entries are created on viewing such an email and compare those logs from time to time.

Libin

[caetano.baiao]

Once again, thanks a lot Libin.  Your input has been of great help to us.

Have a great weekend.

Caetano