Hi, From the mail_logs the SBRS score will be listed in the line with the ICID, Sender Group and mail flow policy Example Snippet from our local labs: ========================================================================== Fri Jun 3 10:25:34 2016 Info: New SMTP ICID 4345 interface Management (10.48.78.15) address 10.48.78.35 reverse dns host ironport.local verified yes Fri Jun 3 10:25:34 2016 Info: ICID 4345 ACCEPT SG UNKNOWNLIST match sbrs[none] SBRS rfc1918 Fri Jun 3 10:25:34 2016 Info: Start MID 6330 ICID 4345 Fri Jun 3 10:25:34 2016 Info: MID 6330 ICID 4345 From: <raed@munich.local> Fri Jun 3 10:25:34 2016 Info: MID 6330 ICID 4345 RID 0 To: <raed@amman.local> Fri Jun 3 10:25:34 2016 Info: MID 6330 Message-ID '<579860dc677ca757a915616d64771c83@munich.local>' Fri Jun 3 10:25:34 2016 Info: MID 6330 Subject 'Final Test - SR 639108941' Fri Jun 3 10:25:34 2016 Info: MID 6330 ready 25877 bytes from <raed@munich.local> Fri Jun 3 10:25:34 2016 Info: MID 6330 matched all recipients for per-recipient policy Raed_Test_Policy in the inbound table  ========================================================================== Since it is a privet IP SBRS rfc1918 is thrown, with public IPs you will not see this, but the point you want is sbrs[none] Regards Raed ... View more

True for multiple attachments the action will be implemented on both, check this ESA Content Filters for Email Messages with Multiple Attachments "the example in the article might be different but the point is that is confirm the actions for multiple attachments will be taken on all if one matches" since this is the way the filters will act by design. ... View more

Hi Rajeev, Give the following a try: Q1) You can create a content filter with condition attachment-protected "which will look for passworded/encrypted attachments". and set the two actions the first one is  drop_attachments("") and the second action to quarantine("Policy") or if you want to send it to the virus quarantine then replace the second action to insert header X-IronPort-AV with value Yes. Q2) You can set the action for  unscannable file in the anti-virus engine to deliver from the advanced setting add a header > then create a filter that will have a condition to see if that header exist and set two actions drop_attachments("") and  insert header X-IronPort-AV with value Yes, so that it will be send to the virus quarantine. Regards Raed  ... View more

in case you want to send them to the spam quarantine you could follow Mathew's suggestion by setting the action to quarantine and then release them and take action based on the CASE engine headers to drop the e-mail from content filters    ... View more

This will send the e-mails to Policy quarantine, i didn't notice that you wrote spam quarantine.   ... View more

Hi, Regarding your queries; Query1: use the following two commands workqueue (to check the e-mails that are pending in the workqueue) and delivernow (allows you to reschedule email in the queue for immediate delivery) Query2: This can be done, to do so please follow these steps with setting the anti-spam engine on the mail policy and the incoming content filter. "Set the action for spam e-mail as deliver and add the header from the advanced settings" check the screenshot   And create the following incoming filter and assign it to the policy in question "or you can do this for the default policy and then inherit the settings to all other policies this way the effect will be on all incoming mail policies" "using the quarantine action with enabling the Duplicate message option" and using the exist option for the header condition . I did a test and it is working as intended "mail_logs": Regards Raed ... View more

Hi, Give the following a try: 1. Create a custom URL category to block files with file extension .exe Keep the sites option empty and just include the following in the Regular expression option (\.exe$) "without the  parenthesis". 2. Associate the newly created custom URL category with an Access policy and set it to "Block". (just go the URL Filtering option of that Access policy and from the Custom URL Category Filtering option set the action for the Custom URL that you created and associated to this policy to Block   ) I did a test in our local labs and it is working "the test was to go to cnet and download avast". Access_logs: 1464697225.302 2 10.63.77.155 TCP_DENIED/403 0 GET http://files.downloadnow.com/s/software/14/53/28/63/avast_free_antivirus_setup_online.exe?token=1464714798_887c4db13f76bc0b022935d22a55acff&fileName=avast_free_antivirus_setup_online.exe - NONE/- - BLOCK_CUSTOMCAT_12-testaccess-test-NONE-NONE-NONE-NONE <C_test,0.0,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_busi,-,"-","-","Unknown","Unknown","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-"> - Regards Raed ... View more

Hi Mike, I would suggest opening a TAC "support" ticket so that the WBRS team can review the URL in question to see if an to investigate it and see if an enhance for the score is possible. Also check the following Senderbase regarding why is m y website's reputation is poor. Regards, Raed ... View more

As per my knowledge ESA local tracking and SMA centralized tracking a separate ... View more

Hi, The centralized email tracking service only provides availability from the time it was enabled but you can search the ESA tracking database by switching to local tracking but NOT committing the changes. To do so you would access the webUI(GUI): * Security Services > Message Tracking > Edit settings > Message Tracking Status: Local Tracking * Submit but don't commit * Monitor > Message Tracking * Perform your search * Switch Message Tracking Status back or logout and abandon changes ... View more

No worries, try the following: You can search the ESA tracking database by switching to local tracking but NOT committing the changes. To do so you would access the webUI(GUI): * Security Services > Message Tracking > Edit settings > Message Tracking Status: Local Tracking * Submit but don't commit * Monitor > Message Tracking * Perform your search * Switch Message Tracking Status back or logout and abandon changes ... View more