The rcpt-count filter condition can help validate if there is a single recipient in the email or multiple.   if (rcpt-count > 1)   Filters cannot split emails based on recipients so it would be expected for the filter to match even when a single recipient matches the condition. ... View more

The ordering guide is available here: https://www.cisco.com/c/en/us/products/collateral/security/email-security/guide-c07-736692.html   Based on that  L-CES-O365P-1Y-S2 should work for 200-499 users.   The Cloud Email Security O365 Premium Bundle is a special premium security bundle for customers using Microsoft Office 365 as their mailbox solution. It contains: ●   Entitlement to the service ●   IPAS ●   VOF ●   DLP ●   Cisco Registered Envelope Service Note:   It does not contain traditional antivirus because that is a built-in feature of O365.   Based on your requirement for scanning you can contact your Cisco reseller to include additional licensed features. Regards, Libin ... View more

Can you confirm which mode you are using the plugin in? Flag or desktop encryption.   If it is set to flag encryption we will need to verify the message tracking for the emails to see if they hit the filter configured to encrypt the email.   The plugin is compatible with the email clients listed below so you can verify that: https://www.cisco.com/c/dam/en/us/td/docs/security/email_encryption/Compatibility_Matrix/Cisco_Email_Encryption_Compatibility_Matrix.pdf   Regards, Libin ... View more

Does not appear to be a compatibility issue:   https://www.cisco.com/c/dam/en/us/td/docs/security/email_encryption/Compatibility_Matrix/Cisco_Email_Encryption_Compatibility_Matrix.pdf   The issues I've seen are usually due to another conflicting plugin disabling the email security plug-in.   You may want to disable the other existing plug-ins one by one to determine what is resulting in the conflict.   Regards, Libin ... View more

This is being tracked under the below enhancement request, however I do not see any workarounds listed.   https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi65382/?reffering_site=dumpcr   The only possible workaround would be to re-inject the email to the ESA or deliver it to another ESA for content filter scanning, however this would certainly increase the load on the appliance if the same email were to be processed by the workqueue twice.   Regards, Libin ... View more

This would be the current design, yes.   This was changed based on requests around Async OS 8 since limits being applied to individual IP's was resulting in the ESA accepting a lot more emails than it should, so the limit is now applied to the complete subnet.   A defect was filed to confirm this and was assessed and confirmed to be how the current working would continue to be.   https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuv17771/?reffering_site=dumpcr   Regards, Libin   ... View more

This does not appear to be the complete logs as it should indicate ICID close or lost to show connection was closed or terminated.   Over TLS, I've observed connections being closed abruptly if the sender is unable to verify the certificate applied to the ESA's inbound listener. You can validate this by setting up a packet capture on the ESA for the sender IP and having them send a couple of test emails.   Alternatively, you can also verify your inbound TLS certificate for the receiving domain using websites such as checktls.com.   Regards, Libin ... View more

If you received the alert during an upgrade, it should be safe to ignore.   Do note that x80 hardware model appliances have a firmware upgrade available that you can contact TAC for.   I do not see a fix planned for the defect as well.   Regards, Libin ... View more

The available options are mentioned in the online help guide under help and support.   Header name : Does the message contain a specific header?   Header value:   Does the value of that header match a certain pattern?   Header value contains terms in the content dictionary.   Does the specified header contain any of the regular expressions or terms in the content dictionary named <dictionary name>   ?   Creating a condition from the GUI content filter is a good way to see the syntax that can be used in message filters.   Regards, Libin ... View more

Hi,   You may want to try using the console access to the VM to see if you can login that way and disable MFA for the administrator account.   You could also try the enablediag username with the same password as admin through console.   Regards, Libin   ... View more

Hi,   I'm not sure if there is a specific configuration for that, if you know certain IP's you would not like to allow emails from you can certainly add them to the HAT Blacklist.   You can also look at implementing SPF, DMARC checks for senders to allow only legitimate emails to come through.   https://www.cisco.com/c/dam/en/us/products/collateral/security/esa-spf-dkim-dmarc.pdf     Regards, Libin ... View more