ironport email security custom setting for email and to view .enc or .raw file.

[CiscoHelpNeeded]

Hi

Using Iron Port email security plugin - Reporting only. version 7.6

I need to do some customization for install.

due to other factors... i need to be able to customize the spam button to send to multilple email addresses.  i see where to set it but unable to get the correct syntax - any thoughts?

also, i need a process on how to view the spam mail sent.  basically extract the .enc or .raw file.  is there a process? any thoughts?

Thanks.

[Robert Sherwin]

We do have a new Cisco Email Reporting Plug-in (v1.0.1): Cisco Email Reporting Plug-in 1.0.1 Administrator Guide

When you are installing the Plug-in, you do have the option to perform a custom install: Using Custom Configuration Files

When you do this, you can modify the config_1.xml that is called during install.

In this file, you'll see the following:

    <reportTypes>&lt;reportType name="spam"&gt;
          &lt;address&gt;outlook_spam@access.ironport.com&lt;/address&gt;
          &lt;copyAddressInPlainFormat&gt;&lt;/copyAddressInPlainFormat&gt;
          &lt;headerValue&gt;spam&lt;/headerValue&gt;
          &lt;showInJunkFolder&gt;true&lt;/showInJunkFolder&gt;
          &lt;largeRibbonButton&gt;true&lt;/largeRibbonButton&gt;
        &lt;/reportType&gt;
        &lt;reportType name="ham"&gt;
          &lt;address&gt;outlook_ham@access.ironport.com&lt;/address&gt;
          &lt;copyAddressInPlainFormat&gt;&lt;/copyAddressInPlainFormat&gt;
          &lt;headerValue&gt;ham&lt;/headerValue&gt;
          &lt;showInJunkFolder&gt;true&lt;/showInJunkFolder&gt;
          &lt;largeRibbonButton&gt;true&lt;/largeRibbonButton&gt;
        &lt;/reportType&gt;
        &lt;reportType name="virus"&gt;
          &lt;address&gt;outlook_virus@access.ironport.com&lt;/address&gt;
          &lt;copyAddressInPlainFormat&gt;&lt;/copyAddressInPlainFormat&gt;
          &lt;headerValue&gt;virus&lt;/headerValue&gt;
          &lt;showInJunkFolder&gt;true&lt;/showInJunkFolder&gt;
          &lt;largeRibbonButton&gt;false&lt;/largeRibbonButton&gt;
        &lt;/reportType&gt;
        &lt;reportType name="phish"&gt;
          &lt;address&gt;outlook_phish@access.ironport.com&lt;/address&gt;
          &lt;copyAddressInPlainFormat&gt;&lt;/copyAddressInPlainFormat&gt;
          &lt;headerValue&gt;phish&lt;/headerValue&gt;
          &lt;showInJunkFolder&gt;true&lt;/showInJunkFolder&gt;
          &lt;largeRibbonButton&gt;false&lt;/largeRibbonButton&gt;
        &lt;/reportType&gt;
        &lt;reportType name="marketing"&gt;
          &lt;address&gt;outlook_mktg@access.ironport.com&lt;/address&gt;
          &lt;copyAddressInPlainFormat&gt;&lt;/copyAddressInPlainFormat&gt;
          &lt;headerValue&gt;marketing&lt;/headerValue&gt;
          &lt;showInJunkFolder&gt;true&lt;/showInJunkFolder&gt;
          &lt;largeRibbonButton&gt;false&lt;/largeRibbonButton&gt;
        &lt;/reportType&gt;</reportTypes>

You'll see the lines here that you can change WHERE you are reporting those messages to.  The only exception is that only one address can be used...

If you were to setup the button to send to like an internal email address "my_spam@example.com" --- and you had a content filter looking for that recipient, you could bcc that over to a mail account in addition to reporting.  Would take some tweaking on a content filter...

As for the .enc - that is controlled from the reporting --- that is controlled as well from the config_1.xml:

      <format>encrypted</format>

In order to see inside the mail, it would need to be plain submission:

Configuring the Encryption of Spam Reports

[CiscoHelpNeeded]

thank you for the follow up.

i may try to put in a mail distribution list to allow for multiple recipients.

for the format option, i have plain set.  I receive it as a .raw file.  is there a method to see inside that?

[Robert Sherwin · Accepted solution]

The .raw file is just that - it's the mail message in a text base format.  You should be able to just 'cat' the file and see the Received, X-, and other headers that constitue the message itself.

[CiscoHelpNeeded]

Thank you for the follow up.  Sorry for the delay.

I can cat the file and see the output.

I was hoping to get a different display, one more user friendly. 

If there is an attachment, how can I extract that to do analysis on?