Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Greg Hopp
09-26-2018
Stats
Member since
12-14-2011
35
Posts
2
Helpful
2
Solutions
07-31-2018
12:15 PM
07-11-2018
01:45 PM
Very good. I've created the message filter. Because I have a bunch of them, I'll probably convert this to a dictionary and add them all there. I'll monitor for success, thanks for the fast reply.
GrH
... View more
07-11-2018
01:08 PM
I want to block all domains that end in .bid, .top and others. I'm ok if they never make it to the various engines for processing and are dropped during the initial SMTP handshake. How best to accomplish?
I put .bid in the RAT with a reject, but I'm seeing .bid emails come thru. Rather not have to play whack-a-mole.
Thank you for any insight.
... View more
Labels:
12-12-2017
04:41 AM
Libin,
That did the trick, thanks. I was focused on Content Filters and sorta forgot about creating a new policy. My solution was to create a policy that skips ALL scans: anti-Spam, anti-Virus, AMP, Graymail, Content & Outbreak filters in order to allow the email with the attachment through.
That's not exactly a desirable policy to apply to everyone, so I narrowed the policy down to just the sender domains the phishing email would be coming from by clicking "Following Senders" and entering in the domains separated by commas. That seems to work great. Our phish tests for employees have resumed!
... View more
12-04-2017
12:52 PM
I have a phishing training vendor who wants to send us email with file attachments. The attachments contain VB code that makes my Ironport's AMP service think they are malicious. The attachments get uploaded to a sandbox for analysis, test positive for malware, and the Ironport dutifully deletes them from the AMP quarantine.
Is there a way to whitelist a particular sender so file attachments are not uploaded to Talos for AMP inspection?
... View more
Labels:
12-04-2017
12:45 PM
For the record, NDR stands for Non-Delivery Report (NDR) in this context.
... View more
03-09-2017
09:04 AM
So to be clear, the formula counts the number of characters that matches between the fake entry and the content dictionary entry and divides by the original number of characters?
If true, then according to my math, the similarity scores should be 27 for Cassi and 36 for Todd. What am I missing?
... View more
02-20-2017
05:45 AM
I am constantly getting this warning on my C170 ESA:
The Warning message is:
75% of the disk quota for Miscellaneous services(logs, configuration file, and so on) is used. You can either increase the disk quota for Miscellaneous services or manually free up space used by Miscellaneous services.
Version: 9.7.2-131
I have increased the available disk for Miscellaneous services, but the System Files Usage is increasing exponentially while the user files is static at < 1Gb. I've logged in and deleted old log files, but it is this System File that appears to be the issue.
Is there a way for me to reduce the System Files Usage? It doesn't appear I have access to it and my Ironport is near or at capacity. I cannot increase the log file size any more than it already is.
Greg
... View more
Labels:
09-22-2016
01:15 PM
Yeah near as I can tell, you need to decide what features you want to have and then pay for those features or buy a bundle that includes several, such as image scanning, graymail, AMP, antivirus, etc.
Agreed it's more complex than it needs to be, wish firms were more transparent about the stuff. Obviously it's not to their competitive advantage.
Greg
... View more
02-09-2016
09:41 AM
But Philip is on the right track; if you haven't already, use SBRS, Sender Base Reputation Score for your sender groups and tighten your thresholds.
For Accept, I'm set to +.50 to +10.0 anything less goes to SuspectList, and the bottom threshold of that isn't very low. Think .50 to -.40; everything else is BL'd.
Greg
... View more
02-09-2016
09:31 AM
Perhaps being lazy, but I wanted to know how to block blank subjects (for the same reason) and am unable to see that in content filters.
I agree, the default reputation sensitivity is not the best, I torqued mine down quite a bit.
... View more
10-23-2015
11:51 AM
Thanks Matthew, you have confirmed my suspicion. Do you have any recommendation on how I can receive this email unmolested by the disclaimer stamp? We like being able to tell at a glance that the email came from outside the org but I need to receive these encrypted emails too. Greg
... View more
Created by
Greg Hopp
in Email Security
in Email Security
10-21-2015
10:29 AM
10-21-2015
10:29 AM
C170 ESA Ironport: So I created a disclaimer on our inbound network listener that brands every email coming thru that listener with a warning that it comes from outside the org. However, that now breaks smime encrypted email that I get from my IPS/IDS monitoring service. Any suggestions on how I can remedy this situation? The supposition is that my ESA breaks the email by either putting the disclaimer on it or trying to. The email I end up getting just contains the text version of the disclaimer, and the error message I get when clicking the smime.p7m file is " This file cannot be previewed because there is no previewer installed for it ".
... View more
Labels:
02-18-2015
04:35 AM
That's good to know. I actually have a notice telling me it's available for me to download and upgrade. After I activate the feature I'll go ahead and do so. Thanks. Greg
... View more
02-17-2015
10:04 AM
Another question. Documentation indicates that the following files are not evaluated: "Text/ALL, image/ALL, application/x-javascript, application/x-shockwave-flash, application/x-empty, and application/javascript." Can you speak to why these file types are not evaluated and whether this is of much concern? Most of are files received are PDFs and Office docs, and most malware comes in as zip content, so I'm thinking this is not considered much of a threat vector? Thanks again, Greg
... View more
07-11-2018
Very good. I've created the message filter. Because I have a bunch of
them, I'll probably convert th...
07-11-2018
I want to block all domains that end in .bid, .top and others. I'm ok if
they never make it to the v...
12-12-2017
Libin, That did the trick, thanks. I was focused on Content Filters and
sorta forgot about creating ...
12-04-2017
I have a phishing training vendor who wants to send us email with file
attachments. The attachments ...
03-09-2017
So to be clear, the formula counts the number of characters that matches
between the fake entry and ...
02-20-2017
I am constantly getting this warning on my C170 ESA: The Warning message
is: 75% of the disk quota f...
09-22-2016
Yeah near as I can tell, you need to decide what features you want to
have and then pay for those fe...
02-09-2016
But Philip is on the right track; if you haven't already, use SBRS,
Sender Base Reputation Score for...
02-09-2016
Perhaps being lazy, but I wanted to know how to block blank subjects
(for the same reason) and am un...
10-23-2015
Thanks Matthew, you have confirmed my suspicion. Do you have any
recommendation on how I can receive...
10-21-2015
C170 ESA Ironport:So I created a disclaimer on our inbound network
listener that brands every email ...
02-18-2015
That's good to know. I actually have a notice telling me it's available
for me to download and upgra...
Public Statistics
| Date Registered | 12-14-2011 10:03 AM |
| Date Last Visited | 09-26-2018 01:58 PM |
| Total Messages Posted | 35 |
| Total Helpful Votes Received | 2 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 10 |
