Hi,
On our Firepower system we block all incoming malware after file lookup.
We have an issue on incoming SMTP traffic; because the incoming malware has been blocked (and connection is reset), the sending SMTP will retry to send us the same mail with the same malware.
This creates a lot of hits in our events; depending on the settings of the sending SMTP server. (Usually 4 times an hour)
Offcourse after while, the sending SMTP server will give up, but by then our firepower already got a lot of events, which makes it hard for us to filter.
Is there a way to block the malware, and tell the sending SMTP server to discard the mail?
