Reading logs from Outgoing Content Filter rules

[Zach Rocha]

I'm trying to figure out if there are any logs created from Outgoing Content Filters. For example:

We have a filter to send all emails with anything SSN (XXX-XX-XXXX) in the subject and it works, but is there a way to see everything that has been caught by that filter? I'll write below the way we have it set up

Condition: Subject Header - subject == "\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b"

Action: Notify - notify ("email_distro@company.com")

Thank you for any help you can provide in advance!!

[Ken Stieers]

In the new gui, you can search by content filter name. There's a checkbox and then a text field for the filter name

We also add a Log Action to any filters that we want to keep a better eye on.

[Zach Rocha]

Thank you for the response Ken! I did see somewhere that you can add the Log Action to the Content Filter, but if I don't have that set am I able to see any logs from that specific filter? Also I'm sorry, but I'm not seeing a search area. Is that in Mail Policies - Outgoing Content Filters?

Thank you again!

[Ken Stieers]

In a mail tracking search, click on Advanced.

The bottom half has a bunch of checkboxes, one should be for outgoing content filter and checking it shows a text box.

[Zach Rocha]

I'm not seeing that as an option. I see "Message Tracking" but it's followed by "The Message Tracking service is currently enabled for centralized tracking. Please log into your Security Management Appliance to see tracking data."

I then log into the Security appliance and see ""Enabled".

I guess to be safe, We are currently using Cisco Secure Email Gateway C600V, if that helps?

[Ken Stieers]

Sounds like you have a SMA and you'll need to go to the SMA to do the tracking.

(SMA is the Security Management Appliance, its where logs and quarantines are centralized)

[Ruben Cocheno]

Create the content filter on the ESA:

1. Navigate to Mail Policies > Incoming/Outgoing content filters
2. Click  Add Filter
3. Name the filter
4. Add condition desired and
5. Click Add Action
6. ChooseNotification
7. Use the email you want and subject  on value box
8. Submit andCommit

As shown in the image (example)

To finish, apply this filter to the desired Incoming/Outgoing Mail Policy.

[Zach Rocha]

Thank you for your response! I have that set up properly, but do you know if you can see a log of everything that has been caught by the rule?