Yes. Sorry. SSLconfig. In the end it's all about being flexible where you can be... inevitably you'll have a business partner somewhere who you can't convince to change their cipher set... so do you send with a weaker cipher? Or with envelope encryption? Or in the clear? Or not at all? ... View more

No order doesn't matter if you use @Strength. Yes just uncheck the 1.0 box if you are PCI. No it doesn deal with the 3DES/DES issues. Add "!DES: !CBC" to remove them. How cipher strings work is documented here: https://www.openssl.org/docs/man1.0.2/man1/ciphers.html If you want to see the end result of your cipher string, in the cli enter "certconfig", then "verify" It will show you the resulting list of ciphers of the config ... View more

Find your security Sales Engineer. They should be able to get you a demo set of licenses for all of the features you want to test. ... View more

>From an ESA point of view, SMA gets you the following: Centralized reporting - (yes doable in Splunk, you'll love ESA 13 with a single log line, but syslog isn't enough) Centralized Quarantines Policy, Virus, and Outbreak Spam Quarantine... which means users only get 1 email if you do spam quarantine notifications. Integration with Cisco Threat Response... though also eventually coming to ESAs For WSA Centralized configuration Centralized reporting Centralized upgrades EVENTUALLY SMA will be the central point of management for ESA too... though that's a long term thing... Umbrella can't do what the WSA can do as far as application control or decrypt and scan content, so you have to look at when/where each one makes sense... Also, Splunk can do lots of stuff, but watch for it becoming expensive as you add more and more data to it... ... View more

Hey Doug Do you have a Threat Grid Device Admin account? You can see most of what that would show you via the Monitoring/File Analysis reports and clicking through, but it's nice to see it all in one place... Check with your sales team, they may not offer it to CES but I'd think that they would... Ken ... View more

They use Win 7 x64 or 10. ... View more

For sure you can up your limit for threat grid uploads, but did they update your CES to 11.x yet? Newer builds are smarter about what they upload, specifically to help avoid this. Default entitlement for on-prem boxes is 200 per box per day, but you may get more from CES based on your size? ... View more

Yes, it was uploaded: 10 Jul 2019 11:10:44 (GMT +03:00) Response received for file reputation query from Cloud. File Name = D1.docm, MID = 13898, Disposition = FILE UNKNOWN, Malware = None, Analysis Score = 0, sha256 = e999dff89c33a98dce5106ef261eeabdae9f7ba6cbb27d6b855fbb16eea4eca6, upload_action = Recommended to send the file for analysis 10 Jul 2019 11:19:47 (GMT +03:00) File analysis complete. MID = 13898, SHA256 = [e999dff89c33a98dce5106ef261eeabdae9f7ba6cbb27d6b855fbb16eea4eca6], File Name = D1.docm, Submit Timestamp = 1562746245, Update Timestamp = 1562746786, Disposition = 1, Score = 72, Analysis Id = 1e80f53fcfc43038b4522c308cf5ae26, Details = None Go to Monitor/File Analysis to see a report of all the files your ESA uploads if you click through the various links you can see the file analysis too. ... View more

"Dynamic content" = executable code or macros ... View more

Correct, you can't use DSR without a load balancer. A more correct statement: DSR is only needed if you use a load balancer. Without a load balancer, I would set the ESA's up with 2 IPs, an inbound listener on one IP, an outbound listener on the other IP. Set the interface names on the inbound listener to an external DNS name (eg. Mail1.company.com, mail2.company.com, etc...) NAT the inbound listener IPs to the internet Allow port 25 from Any to that IP Create an A record for each IP, matching the interface names. Create MX records that point at the A records, each MX record should have the same weight Create an SPF record that looks something like this: "v=spf1 mx -all" (That list isn't exhaustive but hits the high points... ) ... View more

Newer versions of AMP are smarter about what gets uploaded so your upload limit doesn't get used up. If the file has no code in it, it won't get uploaded. If you're testing/verifying that AMP is working, and that files do get uploaded, create a Word doc or Excel doc with a macro in it, and then mail that through. ... View more