Email Security - Server (EX) 11.0.1 Release Notes

New virtual appliance for integrated deployments: model EXintgV

A new virtual system is introduced for Email Security - Server, model EXintgV. This appliance is designed for integrated mode deployments and supports 8-64 GB of RAM, 1-4 TB of disk space, and 4 network interfaces.

VM count in EXintgV models

In Email Security - Server integrated virtual systems, the show version command will now display the maximum running licensed and configured virtual machines.

New columns added to Email Quarantine

View and Download Clean and Riskware Emails

Starting from release 11.0.1, the Search Email tab now provides the option to View and Download Clean and Riskware emails. Previously, the view option was restricted to malicious emails within the eQuarantine > eAlerts tab.

Note

• This feature is available only when the appliance is operating in Block/Drop mode.

• Access to the view and download functions is restricted to Admin users.

• For Clean emails exceeding 2 MB, a download link will be provided instead of a direct in-browser view.

Option to view processed emails

You can now use the View Email action on the Processed Emails page to inspect clean emails, with a toggle to switch between a Parsed and Raw view. Use the following CLIs to manage clean emails:

Delete all added regex being whitelisted

You can now delete all added regex entries at once when they are in large numbers, using the CLI no email-analysis adv-url-defense rewrite whitelist.

Sender-based tracking protection

You can now defang URLs as a part of sender based tracking protection using the CLI [no] email-analysis policy tracking-protection defang enable.

Configuring DUA object size

You can now configure the DUA downloadable object size using the CLI, analysis file max-size dua-file <size>. The default limit of 128 MB has been removed. You can select a size between 1 to 1024 MB. You can also perform static analysis on the partially downloaded objects.

FLOSS artifacts updates on eAlerts page

On the eAlerts page, FLOSS will be shown in the Artifact column whether it is enabled or not. FLOSS artifacts are disabled by default. Disabled FLOSS artifacts will not be displayed in the following situations:

Use the following CLIs to configure FLOSS artifacts.

Bulk configuration on Health Services tab

In the Health Services tab, you can select the newly added check box to enable or disable all services/notifications in bulk.

LDAP client update

The LDAP client now supports the automatic fetching of Certificate Revocation Lists (CRLs), along with existing manual updates feature.

Synchronization with TAXII

The TAXII client within the appliance is now correctly routed through the Fenet proxy (if configured), allowing for successful synchronization with the TAXII server.

WebUI support to release Quarantined Emails by MD5 or URL

The EX WebUI now provides the functionality to release quarantined emails using a URL or MD5 hash, significantly improving incident response workflow. This capability was previously exclusive to the command-line interface (CLI) in version 11.0.0.

Enhanced mutual TLS (mTLS) support for next-hop mail

You can now configure the underlying MTA for client-side mutual TLS (mTLS) for next-hop emails. Use the CLI, email-analysis mta options mtls-request-cert, to enable the EX appliance to send its client certificate to a downstream MTA during the STARTTLS SMTP command handshake, facilitating mTLS.

To use this feature, valid root/intermediate CA certificate, client certificate and client’s private key must be present on the appliance. Also, both the Trellix appliance and the receiving MTA require valid certificates for a successful connection.

To disable the requirement, use [no]email-analysis mta options mtls-request-cert. The MTA will not request a client certificate allowing standard, one-way TLS connections where only the server's certificate is validated.

TLS 1.3 Support for Appliance Management

The appliance base components have been upgraded to fully support TLS 1.3 for management protocols, including the web management interface. This enhancement enforces access rules when Web Client Certificate Authentication is enabled, client certificates are now required for all WSAPI calls, and there is no fallback to other authentication methods for Web Portal access.

Support local time streaming for events

The streamingd service now supports the configuration of event timestamps to reflect the local time zone set on the appliance, rather than the default Coordinated Universal Time (UTC).

Enhanced data streaming configuration guidance for TLS Syslog

You can now follow updated guidance for configuring secure (SSL/TLS) syslog for data streaming. This guide provides the specific settings required to ensure your TLS syslog server (typically on port 6514) is compatible with the standard RFC 5424 format.

The CLI, datastreaming configuration protocol rsyslog consumers <consumer-name> ssl ca-list <option>, now has updated CA list options:

Enhanced certificate authority (CA) list configuration for TLS Syslog

You can now use enhanced configuration options for managing Certificate Authority (CA) lists when setting up secure (SSL/TLS) rsyslog consumers. This update provides greater control and introduces a dynamic default behavior for including CA certificates.

Log manager updates

The Upload option on the Log Manager page used to upload archived files has been removed.

Modified commands