Quarantine for AMP unscannable

[ymadheka]

Hi Team,

In the CES console when the AMP is not able to scan the attachment there is action of Deliver or Drop, customer wants to have quarantine action for these mails. As per my research cisco.com it is not a configurable option.

Can you please advise is there any feature request planned for this?

Appreciate your help here.

 
Thanks & Regards,

Yogesh Madhekar

[Libin Varghese]

Hi Yogesh,

Below is a feature request filed for the same

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCus42111/?reffering_site=dumpcr

A workaround is available to insert a custom header with deliver action and then use a content filter to quarantine unscannable emails further down in the email pipeline.

Thank You!

Libin Varghese

[ymadheka]

Hi Libin,

Thanks for the response.

Is there any document for the workaround mentioned, also can we share this bug search link with the customer?

Thanks & Regards,

Yogesh Madhekar

[Libin Varghese]

Hi Yogesh,

Yes the feature request link can be shared with the customer, however, they would require a Cisco login to access the page.

I do not see a document as it is a customizable configuration depending on the requirement.

I've attached a few screenshot which could help.

Step 1: Insert custom header for AMP Unscannable

Step 2: Create incoming content filter to quarantine emails.

Step 3: Enable content filter on incoming mail policies.

- Libin V