show email-analysis

enabled

Whether analysis mode is enabled or disabled.

mode

Type of analysis mode that is enabled on the Email Security — Server appliance:

For details about how each mode operates, refer to the Email Security — Server User Guide.

interface

Name of the network interface that is used for email analysis. The default network interface is pether3.

TLS receive mode

Options that are configured for transport layer security (TLS) when receiving mode is enabled:

TLS default deliv. mode

Options that are configured for TLS when the default delivery mode is enabled:

MTA certificate name

Name of the message transfer agent (MTA) certificate that verifies the identity of the Email Security — Server appliance to the downstream MTA. You can specify the certificate to be either "mta-cert" or "system-self-signed".

Password-protected objs

Whether objects are password-protected.

cipher list

Type of cipher list that is configured for X.509 (TLS/SSL) certificates.

minimum protocol version

Minimum protocol version that is used to secure email. The default is TLSv1.

Controlled-live-mode enabled

Whether controlled live mode is enabled. When you enable controlled live mode, the Email Security — Server appliance can detect malware that requires remote objects.

For details about controlled live mode, refer to the "Email MTA Configuration" chapter of the Email Security — Server User Guide.

URL dynamic analysis enabled

Whether URL Dynamic Analysis is enabled. When you enable URL Dynamic Analysis (also called DUA), the Email Security — Server appliance can analyze both the URL and the objects the URL references.

For details about URL Dynamic Analysis, "Email MTA Configuration" chapter of the Email Security — Server User Guide.

URL overlay detection enabled

Whether URL overlay detection is enabled. When you enable URL overlay detection, the Email Security — Server appliance can identify suspicious mismatches between the URLs that are embedded in an email message.

For details about URL overlay detection, refer to the "Monitoring Alerts" chapter of the Email Security — Server User Guide.

SNMP statistics interval

Time period to retrieve the SNMP statistics from the Email Security — Server appliance.

Analyze URLs in body

When this option is enabled, URLs that are embedded in an email message body are analyzed.

Analyze attachments

When this option enabled, all email attachments are analyzed.

Analyze email using YARA

Whether YARA analysis is enabled.

Email YARA Weight Cap

The weights of the matched rules are totaled to determine an overall score for the sample.

Max Email Size (MB)

Maximum size (MB) limit for email to be submitted for analysis.

Analysis Timeout (sec)

Number of seconds after which the malware analysis stops if the analysis is not complete.

Analyze image URLs

When this option is enabled, a URL image is submitted for analysis.

Advanced URL Defense

Whether Advanced URL Defense is enabled. The option to parse HTTP links is automatically enabled when Advanced URL Defense is enabled.

Extract/Rewrite HTML URL as Text

Whether rewriting HTML URLs in email as text is enabled.

Max URLs Analyzed/email

Maximum number of URLs that are analyzed per email.

Max Att. Analyzed/email

Maximum number of attachments that are analyzed per email.

Congestion Bypass Mode

Whether bypass congestion mode is enabled.

Congestion Bypass Threshold

When the maximum number of objects in the attachments queue is exceeded, new incoming emails are accepted but are delivered without being analyzed.

Congestion Refuse-connnection Mode

Whether refuse-connection mode is enabled.

Congestion High Threshold

Maximum number of emails in the email queue. When the threshold is exceeded, the SMTP interface is disabled and all new incoming SMTP connections are refused.

Congestion Low Threshold

When the maximum number of emails in the email queue is exceeded, the SMTP interface is re-enabled and all new incoming SMTP connections are accepted.

Enable X Header

Whether the X-Header option is enabled. When deployed in block mode or monitor mode, the appliance adds the X-Headers to describe the analysis and detection results by the Multi-Vector Virtual Execution (MVX) engine.

Use Header for To/From

Whether the Header Envelope feature is enabled. When you enable the Header Envelope feature, the original To: and From: email header information is displayed in the eAlerts page and eQuarantine page in the Email Security — Server Web UI.

Parse HTTPS URLs

Whether the option to parse HTTP links is enabled.

Invoke Email Feature Extractor

Whether the pre-processor for email feature extraction is enabled.

Enable Notice (tap mode)

A notification message is sent to the recipient if a malicious email was detected in Tap/Span mode.

Enable Notice (block mode)

A block notification message is sent to the list of recipients when the Email Security — Server appliance is deployed in block mode.

Block notice from

The From email address header of a block notification message.

Block notice subject

The Subject header of a block notification message.

Block Admin Recipient(s)

Administrators are added to the list of recipients to receive the block notification message.

Block BCC Recipient(s)

Bcc recipients are added to the list of recipients to receive the block notification message.

TypoSquatting

Whether the typosquatting detection feature is enabled. When you enable typosquatting detection, the appliance can analyze suspicious sender and URL domains used in URLs within an email message body.

size

Maximum size of the quarantine in gigabytes. The maximum size is 50 GB. The default size is 20 GB.

cleanup enable

Whether the option to automatically remove emails from the quarantine is enabled.

cleanup keep

Number of days to keep the emails in the quarantine before they are automatically removed.

high-water threshold

Maximum amount of space that can be used in the quarantine. The default threshold is 90 percent.

low-water threshold

Minimum amount of space that can be used in the quarantine. The default threshold is 60 percent.

domain

Name of the domain.

next hop mta

IP address of the next-hop appliance.

MX Enable

Whether the option to use DNS MX record translation on the next-hop IP address is enabled.

TLS mode

Type of TLS policy (opportunistic, mandatory, or verify) that is configured for the MTA to use DNS MX record translation on the next-hop IP address. If a TLS policy is not specified, the value none is used.

Block Notice Enable

Enables or disables sending blocked email notifications to the email recipients on all subdomains of the specified domain. Block notification for global domains must be enabled before individual domain notifications can function.

Subdomain Relay Enable

Enables or disables email on all subdomains for the specified domain.

weight

Weighting value that is specified for outbound connections that need to go to that MTA. The total of the weighting values assigned to the next-hop entries must equal 100.