Use the CLI commands in this procedure to customize the header title and the content of the header message. You can also reset all of the X-header to the default values. X-header text is displayed for each verdict.
For example, you can specify a text string associated with a verdict for the email that contained a malicious URL:
hostname (config) # email-analysis policy xheader mal-url <malicious_URL_text>
The default value is "Malicious URL Found".
Important
Your customization changes will not take effect until you disable the X-Header and enable the X-header again.
Use the
no email-analysis policy xheader enablecommand to disable the X-header.Use the
email-analysis policy xheader enablecommand to enable the X-header.
Enable the advanced X-header feature to:
Insert the X-header "Scan Incomplete" line when the analysis of one or more objects failed.
Insert the X-header "X-FireEye: Riskware Block" line in a copy of the email message when the appliance is in monitor mode.
Insert the X-header "X-FireEye: Riskware Match" line when analysis found a matched riskware policy rule.
For details about how to enable the advanced X-header, see Enabling or disabling the advanced X-header
For details about how to enable a riskware X-header block line, see Customizing riskware X-header block text using the CLI.
For details about how to enable a riskware X-header match line, see Customizing riskware X-header match text using the CLI.
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Specify a custom text string for each header you choose. (If you want to set multiple header customizations, enter them on separate lines.)
hostname (config) email-analysis policy <verdict-type> <header-text>
Verify the customization settings for the X-header.
hostname (config) # show email-analysis policy xheader
Disable the X-header.
hostname (config) # no email-analysis policy xheader enable
Enable the X-header.
hostname (config) # email-analysis policy xheader enable
Save your changes.
hostname (config) # write memory
Restart the SMTP interface.
hostname (config) # email-analysis mta smtp start
The following table lists valid verdict types and header text for customizing the X-headers:
Verdict | Default header text | Command |
|---|---|---|
Header title | X-FireEye |
|
Malicious attachment | Malicious Attachment Found |
|
Malicious attachment and YARA rule match in header and body | Malicious Attachment and Suspicious Header/Body/MIME Contents Found |
|
Malicious attachment and URL | Malicious Attachment and URL Found |
|
Both a malicious attachment and URL. YARA rule match was also found on the header and within an email message body of the header | Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found |
|
YARA rule match on the header and within an email message body of the header | Suspicious Header/Body MIME Contents Found |
|
Malicious URL | Malicious URL Found |
|
Malicious URL, and a YARA rule match was also found on the header and within an email message body of the header | Malicious URL and Suspicious Header/Body/MIME Contents Found |
|
Clean | Clean |
|
Oversubscribed appliance | Not Scanned |
|
One or more objects within the email message was not analyzed completely | Scan Incomplete |
|
Riskware match on the header | Riskware Match |
|
Riskware block on the header | Riskware Block |
|
Valid characters are text, numbers, dash, slash, underscore, comma. and space. The X-header must not start with a special character.
Examples
This example changes the name of the X-header title.
hostname (config) # email-analysis policy xheader hdr-title X-MyCompany
This example changes the X-header text string for an email that contained a clean verdict.
hostname (config) # email-analysis policy xheader val-clean "Clean - BLUE"
This example changes the X-header text string for an email that was not scanned.
hostname (config) # email-analysis policy xheader val-not-scanned "Not Scanned - YELLOW"
This example changes the X-header text string for an email that contained a malicious attachment.
hostname (config) # email-analysis policy xheader mal-att "Malicious Attachment Found - RED"
This example changes the X-header text string for an email that contained a malicious URL.
hostname (config) # email-analysis policy xheader mal-url "Malicious URL Found - RED"
This example changes the X-header text string for an email that contained a YARA rule match on the header and within an email message body of the header.
hostname (config) # email-analysis policy xheader mal-hdr "Suspicious Header/Body/MIME Contents Found - RED"
This example changes the X-header text string for an email that contained a malicious attachment, URL, and YARA rule match on the header.
hostname (config) # email-analysis policy xheader mal-att-url-hdr "Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found - RED"
This example changes the X-header text string for an email that contained a malicious attachment and a YARA rule match on the header.
hostname (config) # email-analysis policy xheader mal-att-hdr "Malicious Attachment and Suspicious Header/Body/MIME Contents Found - RED"
This example changes the X-header text string for an email that contained both a malicious attachment and URL.
hostname (config) # email-analysis policy xheader mal-att-url "Malicious Attachment and URL Found - RED"
This example changes the X-header text string for an email that contained a malicious URL and a YARA rule match on the header.
hostname (config) # email-analysis policy xheader mal-url-hdr "Malicious URL and Suspicious Header/Body/MIME Contents Found - RED"
This example changes the X-header text string if one or more objects within the email message was not analyzed completely.
hostname (config) # email-analysis policy xheader incomplete-scan "Incomplete Scan"
hostname (config) # email-analysis policy xheader incomplete-scan "Incomplete Scan"
This example changes the X-header text string for an email that contained a riskware match on the header.
hostname (config) # email-analysis policy xheader riskware-match "Custom Match Riskware"
This example changes the X-header text string for an email that contained a riskware block on the header.
hostname (config) # email-analysis policy xheader riskware-block "Custom Block Riskware"
This example shows the current X-header customizations.
hostname # show email-analysis policy xheader XHeader values: Default Xheader Title: X-FireEye Configured Xheader Title: X-MyCompany Default Xheader Clean: Clean Configured Xheader Clean: Clean - Blue Default Xheader Not-Scanned: Not Scanned Configured Xheader Not-Scanned: Not Scanned - YELLOW Default Mal. Attach Found: Malicious Attachment Found Configured Mal. Attach Found: Malicious Attachment Found - RED Default Mal. URL Found: Malicious URL Found Configured Mal. URL Found: Malicious URL Found - RED Default Mal. Header Found: Suspicious Header/Body/MIME Contents Found Configured Mal. Header Found: Suspicious Header/Body/MIME Contents Found - RED Default Mal. Attach & Header Found: Malicious Attachment and Suspicious Header/Body/MIME Contents Found Configured Mal. Attach & Header Found: Malicious Attachment and Suspicious Header/Body/MIME Contents Found - RED Default Mal. URL & Header Found: Malicious URL and Suspicious Header/Body/MIME Contents Found Configured Mal. URL & Header Found: Malicious URL and Suspicious Header/Body/MIME Contents Found - RED Default Mal. Attach & URL Found: Malicious Attachment and URL Found Configured Mal. Attach & URL Found: Malicious Attachment and URL Found - RED Default Mal. Attach,URL & Header Found: Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found Configured Mal. Attach,URL & Header Found: Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found - RED Default Xheader Incomplete Scan: Scan Incomplete Configured Xheader Incomplete Scan: Incomplete Scan Configured Xheader Incomplete Scan: Scan Incomplete Default Xheader Riskware Match: Riskware Match Configured Xheader Riskware Match: Custom Match Riskware Default Xheader Riskware Block: Riskware Block Configured Xheader Riskware Block: Custom Block Riskware
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Use the no form of the specific X-header command. For example, to reset the X-header title to the default "X-FireEye" title, enter the following:
hostname (config) # no email-analysis policy xheader hdr-title
Verify the default settings for the X-header.
hostname (config) # show email-analysis policy xheader XHeader values: Default Xheader Title: X-FireEye Configured Xheader Title: X-FireEye Default Xheader Clean: Clean Configured Xheader Clean: Clean Default Xheader Not-Scanned: Not Scanned Configured Xheader Not-Scanned: Not Scanned Default Mal. Attach Found: Malicious Attachment Found Configured Mal. Attach Found: Malicious Attachment Found Default Mal. URL Found: Malicious URL Found Configured Mal. URL Found: Malicious URL Found Default Mal. Header Found: Suspicious Header/Body/MIME Contents Found Configured Mal. Header Found: Suspicious Header/Body/MIME Contents Found Default Mal. Attach & Header Found: Malicious Attachment and Suspicious Header/Body/MIME Contents Found Configured Mal. Attach & Header Found: Malicious Attachment and Suspicious Header/Body/MIME Contents Found Default Mal. URL & Header Found: Malicious URL and Suspicious Header/Body/MIME Contents Found Configured Mal. URL & Header Found: Malicious URL and Suspicious Header/Body/MIME Contents Found Default Mal. Attach & URL Found: Malicious Attachment and URL Found Configured Mal. Attach & URL Found: Malicious Attachment and URL Found Default Mal. Attach,URL & Header Found: Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found Configured Mal. Attach,URL & Header Found: Malicious Attachment, URL and Suspicious Header/Body/MIME Contents Found Default Xheader Incomplete Scan: Scan Incomplete Configured Xheader Incomplete Scan: Scan Incomplete Default Xheader Riskware Match: Riskware Match Configured Xheader Riskware Match: Riskware Match Default Xheader Riskware Block: Riskware Block Configured Xheader Riskware Block: Riskware Block
Save your changes.
hostname (config) # write memory