cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.0.0-698
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.0.0-404
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

3636
Views
0
Helpful
5
Replies
mlynch_ironport
Beginner

Incoming Blacklist in the Inbound Table

How do I identify what triggered the dropping of the specific mails? I have created many Envelope Sender blocks in the Incoming Content Filter.

The message tracking shows that the mail has been dropped, but I can't see which of the filters caused it to drop that specific mail...

5 REPLIES 5
kyerramr
Beginner

If a message is dropped by a content filter then this should be displayed in the tracking information as such "Dropped by content filter 'test' in ...." Also, check to see if the message is dropped by CASE (IronPort Antispam engine) or the content filter.

mlynch_ironport
Beginner

Hi, Thanks for your response. I use the created, "Incoming_XXX_Blacklist as the top level folder and have many "envelope senders within it. I guess I should have kept the individual envelope senders at the "root" of the filter. Is there a way to copy the file and import it to the "root" as separate entries? It is working just fine, I just can't see some of the causes for dropping some of the mails. By the way, this C160 appliance is light years ahead of the old SurfControl mail filter and will save me umpteen hours a week of management. I love it already. The only thing that I can't find, is a way to see the mails content to be sure it deserves to be dropped. We do not allow any non-business mailings and I could need to know if what appears to be personal chatter could be sales generated chatter.

jmonrad
Beginner

Hi, Thanks for your response. I use the created, "Incoming_XXX_Blacklist as the top level folder and have many "envelope senders within it. I guess I should have kept the individual envelope senders at the "root" of the filter. Is there a way to copy the file and import it to the "root" as separate entries? It is working just fine, I just can't see some of the causes for dropping some of the mails. By the way, this C160 appliance is light years ahead of the old SurfControl mail filter and will save me umpteen hours a week of management. I love it already. The only thing that I can't find, is a way to see the mails content to be sure it deserves to be dropped. We do not allow any non-business mailings and I could need to know if what appears to be personal chatter could be sales generated chatter.


Hi,

I can also recommend using the trace functionality, under System Administration -> Trace .. Here you can test a policy or see which policy is triggered when filing in details like body, ip, sender and recipient..

mlynch_ironport
Beginner

I have not found the Trace feature able to view a specific mails body content. I would need to see the actual text (body) of certain mails to further decide if it is junk or valid in a Pharma environment. Example:

Viagra Pfizer 50mg $2 (junk) or Viagra Pfizer 50mg 2 up (good)

The subject matter does not show the full picture. Is there a method to view the mails?

M.L.

jmonrad
Beginner

I have not found the Trace feature able to view a specific mails body content. I would need to see the actual text (body) of certain mails to further decide if it is junk or valid in a Pharma environment. Example:

Viagra Pfizer 50mg $2 (junk) or Viagra Pfizer 50mg 2 up (good)

The subject matter does not show the full picture. Is there a method to view the mails?

M.L.


I see your point, there is not really an easy way to read e-mails on the Ironport appliance as it don't store full e-mails. But perhaps one thing you could do is to quarantine and copy, then you will have a copy of the e-mail and the e-mail will not be delayed as it will be delivered to the recipient..

Content for Community-Ad