cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.2.0-616
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.2.0-203
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

2113
Views
0
Helpful
2
Replies
Maros RAJNOCH
Beginner

How to match envelope/smtp header MAIL FROM and FROM: specified in message body?

Hello dear ESA strong & passion admins,

 

can Cisco ESA filter messages where envelope/smtp header MAIL FROM do not match FROM: specified in message body, which is rendered by MUA (e.g. Outlook)?

 

Thanks a lot

2 REPLIES 2
alvinrichburg
Beginner

As a preliminary answer I would advise looking into message filters. I haven't used them for your particular request, however matching information inthe body of a message is possible using them. Here is a link to the documentation on message filters:

 

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.pdf

 

Please follow up if you have any questions. 

Maros RAJNOCH
Beginner

@pmesjar helps us, with focusing on new feature in AsyncOS 10.0, called Forged Email Detection:

https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/whitepaper_C11-737596.html

 

Thanks to all.

 

Create
Recognize Your Peers
Content for Community-Ad