About Raed Boshmaf

Raed Boshmaf · ‎01-09-2017

Just join the cluster from the second machine CLI > clusterconfig > join over ssh/ccs "based on how you configured things" and after the join the settings should be inhered from the cluster Regards Raed

Raed Boshmaf · ‎01-09-2017

Check the following article it might be of use ESA Centralizing Policy, Virus, and Outbreak Quarantine (PVO) Cannot be Enabled Regards Raed

Raed Boshmaf · ‎01-09-2017

Hi Clement Most likely there is an override between the machine/cluster level for the Policy, Virus and Outbreak quarantine(PVO) From the CLI run the following command clustercheck Regards Raed

Raed Boshmaf · ‎01-06-2017

Hi Regarding your question the logs will be send to the syslog server. if you want to keep a copy of these logs on your appliance then just create another copy of these logs with an open of manual download. so for example create to two mail_logs of type I ronPort Text Mail Logs mail_logs_local with a manual download option "local logging on the machine" and mail_logs_syslog with syslog configured on it "external logging". Regards Raed

Raed Boshmaf · ‎09-01-2016

Hi Daniel, Emails CASE/IMS "Spam-Engines" are kept unpublished "only visible at the back-end". since showing the scores for emails means that the people that create spam emails can find out how and what email format get's what score "and hence spammers can see what they need to do to trick the system". So what i would suggest is opening a TAC case for these FN "missed-spam" emails so that they can be reviewed and get a rule publish. Also regrading the email that had zepto Ransomware it should have been detected by your AV engine(s). in case the tracking/mail_logs are showing that the AV engines(s) didn't detect it then opening a TAC case would help with that since this file needs to be escalated to the AV team that you are using on your appliance "Sophos for example" so that they can review the file to see if it is already detected " there is an already published IDE to address it" or if an IDE publish is needed. Regards Raed

Raed Boshmaf · ‎08-23-2016

Hi deivagandhi, Yes. you can delete these expired certificates since there were replaced with the Cisco Appliance Demo certificate in newer AsycOS versions. Regards Raed

Raed Boshmaf · ‎08-19-2016

it doesn't work via the content filters "GUI", since the condition attachment-binary-contains doesn't exist in them. Regards Raed

Raed Boshmaf · ‎08-18-2016

Hi John, You can implement the following message filter: "you said that you want to block send as outgoing emails, in case you want to drop these emails then you can remove the first condition and the filter will take effect on all traffic; outgoing and incoming. also if you are going to implement the filter i would suggest using a quarantine("Policy"); action instead of the drop(); action at first to test the filter around and see how it behaves after that "making sure you are not having FP issues" you can change the action to drop(); the more aggressive one or you can use an action as drop-attachments-by-size(0) which should drop the attachment only and not the hole email ". iIf (sendergroup != "RELAYLIST") { if ( (attachment-filename == "(?i)\\.(xls|doc|ppt|xlsx|docx|pptx|docm|dotm|xlsm|xltm|xlam|pptm|potm|ppam|ppsm|sldm)$") AND (attachment-binary-contains("(?i)x-vba-macros")) OR (attachment-binary-contains("[Vv][Bb][Aa]")) AND(attachment-binary-contains("(?i)versioncompatible32") ) ) { log-entry("MacroFilter took effect"); drop(); } } . the filter should check if the sender-group is matching relaylist "outgoing emails" (or this condition can be replaced with recv-listener=="OutgoingEmails"; in case you have multiple listener for incoming/outgoing traffic) and then test the rest of the conditions. "also you can edit the filter to include more extensions in case i forgot some" Regards Raed

Raed Boshmaf · ‎08-11-2016

Hi Sandy, Give the following articles a read, they have multiple methods to deal with spoofing emails, hope they help! ESA Spoofed Mail Filtering Spoof Protection using Sender Verification ESA SMTP Authentication Condition to Prevent Spoofing Quarantine Spoofed Email Messages on the ESA and Create Exceptions For Senders That Are Allowed To Spoof Regards, Raed

Raed Boshmaf · ‎06-20-2016

Hey Jason, If possible get a Content Security Management Appliance ( SMA) image / license and use the centralized reporting function of the Cisco Content Security Management Appliance you will have the following centralized options: 1. M essage tracking 2. W eb tracking - in case you have WSAs in your network 3. Reporting 4. Spam Quarantine 5. Policy, Virus and Outbreak Quarantines For more information regarding Content Security Management Appliance ( SMA) check this and the Centralized Reporting from the ESA user guide Regards Raed

Raed Boshmaf · ‎06-14-2016

Hi irsahd, You should be able to search for the Subject as it is from the message tracking or grep the mail_logs from the CLI. And from there you can get all the information you are looking for. Regards Raed

Raed Boshmaf · ‎06-06-2016

No worries

Raed Boshmaf · ‎06-06-2016

Hi Mansoor, Query 1: Possible, in the end this is your deployment and you can go with doing things in different ways, but the point is that the Block is happening due to the e-mail being assosiated with BLAKLIST sender group which has the BLOCKED mail flow policy which will drop the e-mail at listener level. Query2: From CLI <mail_logs> s ome of the things that comes to my mind is something like grep "sender group" mail_logs > where sender group is the name of the sender group that you know that these bad scores will be assigned to. Another one would be to do something like grep "SBRS" mail_logs, this will show you the e-mails based on SBRS score and from there you can filter the e-mails that have bad scores From GUI webUI(GUI) > Monitor > Sender groups Also you can create a filter that with conditions based on reputation that will do an action of logging, and you can track how many times the filter took place from webUI(GUI) > Monitor > Message filter "this will give you an estimate of the number of e-mail with bad score that you receive" example of the filter Log_Bad_SBRS: if(reputation < 0.0) { log-entry("This e-mail has a bad SBRS score!"); } . Regards Raed

Raed Boshmaf · ‎06-06-2016

Hi Cristian, Check the following BUG OpenSSL -- TLS 1.1, 1.2 denial of service vulnerability CVE-2012-4929 is assigned with it, and the BUG report says that 8.0.1-023 is a Known Fixed Release, so newer GD releases shouldn't have this issue too. Regards Raed

Raed Boshmaf · ‎06-06-2016

Hi, Just implement the following incoming content filter and assign it to the incoming mail policy in question: Condition > attachment-filetype == "Executable" Action > Quarantine("Policy") [You can change this into drop after testing the filter and seeing how it performs] The reason for this is the fact that the filter will do body-scanned for .zip files and .rar files, which means that the filter will check .zip files and .rar files for excusable "condition" and take actions based on the filter "Quarantine in this case". Ref: AsyncOS version 9.7.1 user guide page 212 Note about your filter, from the drop down list next to conditions are you using If one or more conditions match "aka OR" or Only if all conditions match "aka AND". Regards Raed

Date Registered	‎11-27-2015 05:02 AM
Date Last Visited	‎09-25-2019 12:21 AM
Total Messages Posted	58
Total Helpful Votes Received	30