Customizing or resetting the X-header text using the CLI

Prev Next

Use the CLI commands in this procedure to customize the header title and the content of the header message. You can also reset all of the X-header to the default values. X-header text is displayed for each verdict.

For example, you can specify a text string associated with a verdict for the email that contained a malicious URL:

hostname (config) # email-analysis policy xheader mal-url <malicious_URL_text>

The default value is "Malicious URL Found".

Important

Your customization changes will not take effect until you disable the X-Header and enable the X-header again.

Use the no email-analysis policy xheader enable command to disable the X-header.

Use the email-analysis policy xheader enable command to enable the X-header.

Enable the advanced X-header feature to:

  • Insert the X-header "Scan Incomplete" line when the analysis of one or more objects failed.

  • Insert the X-header "X-FireEye: Riskware Block" line in a copy of the email message when the appliance is in monitor mode.

  • Insert the X-header "X-FireEye: Riskware Match" line when analysis found a matched riskware policy rule.

For details about how to enable the advanced X-header, see Enabling or disabling the advanced X-header

For details about how to enable a riskware X-header block line, see Customizing riskware X-header block text using the CLI.

For details about how to enable a riskware X-header match line, see Customizing riskware X-header match text using the CLI.

To customize the X-header text:
  1. Go to CLI configuration mode.

    hostname > enable
    hostname # configure terminal
  2. Specify a custom text string for each header you choose. (If you want to set multiple header customizations, enter them on separate lines.)

    hostname (config) email-analysis policy <verdict-type> <header-text>
  3. Verify the customization settings for the X-header.

    hostname (config) # show email-analysis policy xheader
  4. Disable the X-header.

    hostname (config) #  no email-analysis policy xheader enable
  5. Enable the X-header.

    hostname (config) # email-analysis policy xheader enable
  6. Save your changes.

    hostname (config) # write memory
  7. Restart the SMTP interface.

    hostname (config) # email-analysis mta smtp start

The following table lists valid verdict types and header text for customizing the X-headers:

Verdict

Default header text

Command

Header title

X-FireEye

email-analysis policy xheader hdr-title <header_name>

Malicious attachment

Malicious Attachment Found

email-analysis policy xheader mal-att <malicious_attachment_text>

Malicious attachment and YARA rule match in header and body

Malicious Attachment and Suspicious Header/Body/MIME Contents Found

email-analysis policy xheader mal-att-hdr <malicious_attachment_header_text>

Malicious attachment and URL

Malicious Attachment and URL Found

email-analysis policy xheader mal-att-url <malicious_attachment_url_text>

Both a malicious attachment and URL. YARA rule match was also found on the header and within an email message body of the header

Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found

email-analysis policy xheader mal-att-url-hdr <malicious_attachment_URL_header_text>

YARA rule match on the header and within an email message body of the header

Suspicious Header/Body MIME Contents Found

email-analysis policy xheader mal-hdr <malicious_header_text>

Malicious URL

Malicious URL Found

email-analysis policy xheader mal-url <malicious_URL_text>

Malicious URL, and a YARA rule match was also found on the header and within an email message body of the header

Malicious URL and Suspicious Header/Body/MIME Contents Found

email-analysis policy xheader mal-url-hdr <malicious_URL_header_text>

Clean

Clean

email-analysis policy xheader val-clean <clean_text>

Oversubscribed appliance

Not Scanned

email-analysis policy xheader val-not-scanned <not_scanned_text>

One or more objects within the email message was not analyzed completely

Scan Incomplete

email-analysis policy xheader incomplete-scan <incomplete_scan_text>

Riskware match on the header

Riskware Match

email-analysis policy xheader riskware-match <riskware_match_text>

Riskware block on the header

Riskware Block

email-analysis policy xheader riskware-block <riskware_block_text>

Valid characters are text, numbers, dash, slash, underscore, comma. and space. The X-header must not start with a special character.

Examples

This example changes the name of the X-header title.

hostname (config) # email-analysis policy xheader hdr-title X-MyCompany

This example changes the X-header text string for an email that contained a clean verdict.

hostname (config) # email-analysis policy xheader val-clean "Clean - BLUE"

This example changes the X-header text string for an email that was not scanned.

hostname (config) # email-analysis policy xheader val-not-scanned "Not Scanned - YELLOW"

This example changes the X-header text string for an email that contained a malicious attachment.

hostname (config) # email-analysis policy xheader mal-att "Malicious Attachment Found - RED"

This example changes the X-header text string for an email that contained a malicious URL.

hostname (config) # email-analysis policy xheader mal-url "Malicious URL Found - RED"

This example changes the X-header text string for an email that contained a YARA rule match on the header and within an email message body of the header.

hostname (config) # email-analysis policy xheader mal-hdr "Suspicious Header/Body/MIME Contents Found - RED"

This example changes the X-header text string for an email that contained a malicious attachment, URL, and YARA rule match on the header.

hostname (config) # email-analysis policy xheader mal-att-url-hdr "Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found - RED"

This example changes the X-header text string for an email that contained a malicious attachment and a YARA rule match on the header.

hostname (config) # email-analysis policy xheader mal-att-hdr "Malicious Attachment and Suspicious Header/Body/MIME Contents Found - RED"

This example changes the X-header text string for an email that contained both a malicious attachment and URL.

hostname (config) # email-analysis policy xheader mal-att-url "Malicious Attachment and URL Found - RED"

This example changes the X-header text string for an email that contained a malicious URL and a YARA rule match on the header.

hostname (config) # email-analysis policy xheader mal-url-hdr "Malicious URL and Suspicious Header/Body/MIME Contents Found - RED"

This example changes the X-header text string if one or more objects within the email message was not analyzed completely.

hostname (config) # email-analysis policy xheader incomplete-scan "Incomplete Scan"

hostname (config) # email-analysis policy xheader incomplete-scan "Incomplete Scan"

This example changes the X-header text string for an email that contained a riskware match on the header.

hostname (config) # email-analysis policy xheader riskware-match "Custom Match Riskware"

This example changes the X-header text string for an email that contained a riskware block on the header.

hostname (config) # email-analysis policy xheader riskware-block "Custom Block Riskware"

This example shows the current X-header customizations.

hostname # show email-analysis policy xheader
XHeader values:
Default Xheader Title:                     X-FireEye
Configured Xheader Title:                  X-MyCompany
Default Xheader Clean:                     Clean
Configured Xheader Clean:                  Clean - Blue
Default Xheader Not-Scanned:               Not Scanned
Configured Xheader Not-Scanned:            Not Scanned - YELLOW
Default Mal. Attach Found:                 Malicious Attachment Found
Configured Mal. Attach Found:              Malicious Attachment Found - RED
Default Mal. URL Found:                    Malicious URL Found
Configured Mal. URL Found:                 Malicious URL Found - RED
Default Mal. Header Found:                 Suspicious Header/Body/MIME Contents Found
Configured Mal. Header Found:              Suspicious Header/Body/MIME Contents Found - RED
Default Mal. Attach & Header Found:        Malicious Attachment and Suspicious Header/Body/MIME Contents Found
Configured Mal. Attach & Header Found:     Malicious Attachment and Suspicious Header/Body/MIME Contents Found - RED
Default Mal. URL & Header Found:           Malicious URL and Suspicious Header/Body/MIME Contents Found
Configured Mal. URL & Header Found:        Malicious URL and Suspicious Header/Body/MIME Contents Found - RED
Default Mal. Attach & URL Found:           Malicious Attachment and URL Found
Configured Mal. Attach & URL Found:        Malicious Attachment and URL Found - RED
Default Mal. Attach,URL & Header Found:    Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found
Configured Mal. Attach,URL & Header Found: Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found - RED
Default Xheader Incomplete Scan:           Scan Incomplete
Configured Xheader Incomplete Scan:        Incomplete Scan
Configured Xheader Incomplete Scan:        Scan Incomplete
Default Xheader Riskware Match:            Riskware Match
Configured Xheader Riskware Match:         Custom Match Riskware
Default Xheader Riskware Block:            Riskware Block
Configured Xheader Riskware Block:         Custom Block Riskware
To reset the X-header text to the default values:
  1. Go to CLI configuration mode.

    hostname > enable
    hostname # configure terminal
  2. Use the no form of the specific X-header command. For example, to reset the X-header title to the default "X-FireEye" title, enter the following:

    hostname (config) # no email-analysis policy xheader hdr-title 
  3. Verify the default settings for the X-header.

    hostname (config) # show email-analysis policy xheader
    XHeader values:
    Default Xheader Title:                     X-FireEye
    Configured Xheader Title:                  X-FireEye
    Default Xheader Clean:                     Clean
    Configured Xheader Clean:                  Clean
    Default Xheader Not-Scanned:               Not Scanned
    Configured Xheader Not-Scanned:            Not Scanned
    Default Mal. Attach Found:                 Malicious Attachment Found
    Configured Mal. Attach Found:              Malicious Attachment Found
    Default Mal. URL Found:                    Malicious URL Found
    Configured Mal. URL Found:                 Malicious URL Found
    Default Mal. Header Found:                 Suspicious Header/Body/MIME Contents Found
    Configured Mal. Header Found:              Suspicious Header/Body/MIME Contents Found
    Default Mal. Attach & Header Found:        Malicious Attachment and Suspicious Header/Body/MIME Contents Found
    Configured Mal. Attach & Header Found:     Malicious Attachment and Suspicious Header/Body/MIME Contents Found
    Default Mal. URL & Header Found:           Malicious URL and Suspicious Header/Body/MIME Contents Found
    Configured Mal. URL & Header Found:        Malicious URL and Suspicious Header/Body/MIME Contents Found
    Default Mal. Attach & URL Found:           Malicious Attachment and URL Found
    Configured Mal. Attach & URL Found:        Malicious Attachment and URL Found
    Default Mal. Attach,URL & Header Found:    Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found
    Configured Mal. Attach,URL & Header Found: Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found
    Default Xheader Incomplete Scan:           Scan Incomplete
    Configured Xheader Incomplete Scan:        Scan Incomplete
    Default Xheader Riskware Match:            Riskware Match
    Configured Xheader Riskware Match:         Riskware Match
    Default Xheader Riskware Block:            Riskware Block
    Configured Xheader Riskware Block:         Riskware Block
  4. Save your changes.

    hostname (config) # write memory