How to rescan policy/content Quarantine with Anti Spam at release time

[MuZeeshan28731]

Can anyone help me to find workaround how to rescan policy/content Quarantine with Anti Spam at release time?

we are quarantining suspicious spams for 2 hours and releasing after 2 hours.

 at release AV and AMP is rescaning but anti-spam is not. Do we have any workaround? 

[balaji.bandi]

It all depends on Poliicy what kind of SPAM block, as per i know you need manually release that is what one of client used to do.

Overview of Anti-Spam Scanning

https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01100.html#con_1273840

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118220-technote-esa-00.html

[MuZeeshan28731]

Hi,

polices are set already. ONLY suspected spam emails are being quarantines in a folder and getting released after 2 hours with tag, disclaimer and re-written URLs. 

At the release time AV and AMP are re-scanning but AS is not. Any workaround to force emails being released to get re-scanned from AS?

Manual release is not possible as we are talking about 1000s of emails per week in this category. 

[Prab]

Hi,

Messages released from a policy quarantine are not re-scanned by the AntiSpam engine, this is by-design.

Ref: https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011111.html#con_1121783

Cheers,

Prab