cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1323
Views
5
Helpful
1
Replies

SMA Custom Report for Manually Released emails from Quarantines

amelo@
Beginner
Beginner

Is there a way to generate a report of emails that have been manually released from the Policy, Virus and Outbreak Quarantines in the SMA?

 

Thanks,

1 Reply 1

marc.luescherFRE
Spotlight
Spotlight

Hi there,

 

sorry there is no report available at the SMA to report on this activity, even I also think this could be helpfull.

I am currently checking if such information could be made available when uploading raw data of the ESA/SMA to a SIEM.

 

Update :

Searching for "ISQ Released Message" or "released from quarantine" & "manual" in mail_logs would allow you to count and identify such messages in a SIEM. The SMA re-inserts such messages back to the ESA so you would need to search the ESA logs for such messages.

 

A document describing the release messages can be found here:

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118286-technote-csa-00.html

 

 

I hope this helps

 

-Marc

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: