We (like anyone) get a ton of malware via SMTP. It gets blocked but I have no way to report to management what the malware was, what the business risk is, etc. Cisco support said to turn on capture so it can get the file on Firesight, but still there...