To generate email sender impersonation riskware alerts or block email for senders that match the following high and low impersonation detection rules, you must configure settings using the Web UI or CLI.
65027, High Confidence Email Impersonation Weights 80-99 Matched65028, Low Confidence Email Impersonation Weights 50-79 Matched
Prerequisites
An established connection between the Email Security - Server appliance and the Internet.
You are logged in to the Web UI with Admin and Operator access.
To alert or quarantine impersonation detection rules for low and high confidence using the Web UI:
Go to the Settings > Riskware Policy page.
In the Riskware Policy Rules table, select rule ids 65027 and 65028.
Select Alert Only or clear Quarantine.
To enable impersonation detection rules for low and high confidence using the CLI:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Enable an impersonation detection rule for high confidence.
hostname (config) # analysis riskware policy rule 65027 enableEnable an impersonal detection rule for low confidence.
hostname (config) # analysis riskware policy rule 65028 enable
To block impersonation detection rules for low and high confidence using the CLI:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Block an impersonation detection rule for high confidence.
hostname (config) # analysis riskware policy rule 65027 blockBlock an impersonation detection rule for low confidence.
hostname (config) # analysis riskware policy rule 65028 block