Ironport integration with Symantec Enterprise Vault

[Rick Williams]

Hi,

I am in the process of installing Symantec Enterpise Vault 9. As part of our organisation security measures we take copies of all mail both inbound and outbound mail. On our Ironports (C650 and C350D's. OS 7.1.2-020) we also add disclaimers.

I have two questions regarding the process on how best to do this.

1) Is the only way to copy a mail is by using the bcc option? Is there not a duplicate the mail option hidden away to allow a "perfect copy"?

2) Is there a way to take the copy of the mail after the disclaimer has been added?

I am currently using the below filter:

{
add-footer("XXXXXX");
bcc (xxx@yyy.local, "$Subject", "postmaster@zzz.com");
}

Any suggestions or input would be much appreciated,

Rick.

[Christopher Smith]

Hi Rick,

There are other ways to copy a message but I think the option your using may be the best choice based on what your describing. Is the filter working as desried? It looks ok to me.

You can perform a notify action and include a copy of the message but I am not sure this would meet your exact needs because you would likely end up with a copy of the message as an attachment.  Since you mention you need an exact copy I think the BCC is the best way to go here.

Christopher C Smith

CSE

Cisco IronPort Customer Support

[Rick Williams]

Hi Chris,

Thanks for the answer. The filter does work, however, is it possible to take a copy of the mail after the disclaimer has been added?

My dilema is that for certain countries (eg France) we need to be able to prove the disclaimer was send out on the email and with the French part first.

[viahmed]

Hi Rick,

How about adding an another message filter next in order to check whether or not disclaimer has been added and perform 'bcc' based on the results.

============

disclaimer:
if (body-contains('[dD]isclaimer',1))

{

bcc('administrator@example.com');
}

============

My two cents:)

Cheers,

Viquar Ahmed

Customer Support Engineer

[Rick Williams]

Hi.

Thanks for the input. I've stuck with my original method in the filter as I could not get the disclaimer copy working. That would have been more than a benefit than anything.

One thing I'd like to add here for anyone looking at the integration of EV with Ironports using this option is that it doesn't "quite" conform to how EV expects the mails to arrive.

Enterprise Vault looks for the sender of the email and then attempts to store into domain and user mailboxes to be archived into the vault.

ie

Domain1

     a.user

     b.user

     c.user

Domain2

     a.user

     g.user

     f.tester

etc etc

Instead you will only get 1 mailbox and 1 domain which will be the user and domain you are sending the BCC from.

So in my original post here, you would see all mails stored under

example.com

     administrator

It does not affect the performance of EV as far as I can see as the SMTP archiving function relies on their File System archiving technology.

The only possible resolution to this, and I certainly do not have the skills, would be to pick out the from address in the email and insert it into the BCC filter rule. No idea if that's even possible.

Maybe Cisco will come up with some option for creating an identicle copy of a mail after the disclaimer has been added. I'm sure I'm not the only person out there who has this kind of setup.

Thanks for the advice.

Rick.

[exMSW4319]

I'm grabbing blindly from the manual here, but did you try a Send Copy (BCC) $EnvelopeRecipients followed by a Change Recipient to your vault address?

The idea is that the original recipients would get the copy via some rather backwards logic, whilst the original message would go into the vault. However, the action variable might not handle CCs and BCCs properly. Test with care.