I have a case open with Cisco on this and we believe we are doing everything right yet we can not break up our top level state wide domain to report the sub domains individually. We are a state government. Are any of you doing this, it would be like taking state.gov and breaking it up into individual departments like so.
department1.state.gov
department2.state.gov
department3.state.gov
we want to do this so that we can see in the canned report where our mail is coming from and where it is going in the state, right now our top sender is state.gov and so it our top receiving domain, and that's not very useful / helpful if its an aggregate of over 100 departments, and drilling into state.gov goes too far and shows us the individual senders ie hosts not the individual sub domains ie departments
here's a link the the Cisco documentation
https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma11-0/user_guide/b_SMA_Admin_Guide/b_SMA_Admin_Guide_chapter_011.pdf
To generate reports for a subdomain, you must add its parent domain as a second-level domain in the reporting system of the Email Security appliance and the Security Management appliance.
For example, if you add example.com as a second-level domain, its subdomains, such as subdomain.example.com, are available for reporting.
To add second-level domains, use reportingconfig -> mailsetup -> tld in the Email Security appliance CLI, and reportingconfig -> domain -> tld in the Security Management appliance CLI.
