show email-analysis policy

Analyze URLs in body

Whether URL scanning is enabled so that the Email Security — Server appliance can scan URLs within an email message body and either allow or block access to URLs.

Analyze attachments

Whether the EMPS_ATTACHMENT_SCAN license is enabled so that the Email Security — Server appliance can submit email attachments for analysis.

Analyze email using YARA

Whether YARA analysis is enabled.

Email YARA Weight Cap

The weights of the matched rules are totaled to determine an overall score for the sample.

Max Email Size (MB)

Maximum size (MB) limit for email to be submitted for analysis.

Analysis Timeout (mins)

Number of minutes after which the malware analysis stops if the analysis is not complete.

Analyze image URLs

When this option is enabled, a URL image is submitted for analysis.

Advanced URL Defense

Whether Advanced URL Defense is enabled. The option to parse HTTP links is automatically enabled when Advanced URL Defense is enabled.

Extract/Rewrite HTML URL as Text

Whether rewriting HTML URLs in email as text is enabled.

Max URLs Analyzed/email

Maximum number of URLs that are analyzed per email.

Max Att. Analyzed/email

Maximum number of attachments that are analyzed per email.

Congestion Bypass Mode

Whether bypass congestion mode is enabled.

Congestion Bypass Threshold

When the number of objects in the attachments queue exceeds this threshold, new incoming emails are accepted but are delivered without being analyzed.

Congestion Refuse-connnection Mode

Whether refuse-congestion mode is enabled.

Congestion High Threshold

When the number of emails in the email queue exceeds this threshold, the SMTP interface is disabled and all new incoming SMTP connections are refused.

Congestion Low Threshold

When the number of emails in the email queue falls below this threshold, the SMTP interface is re-enabled and all new incoming SMTP connections are accepted.

Enable X Header

Whether the X-Header option is enabled. If the advanced X-Header option is enabled, the "Adv. X-header" setting is displayed. When deployed in block mode or monitor mode, the appliance adds the X-Headers to describe the analysis and detection results by the Multivector Virtual Execution (MVX) engine.

Use Header for To/From

Whether the Header Envelope feature is enabled. When you enable the Header Envelope feature, the original To: and From: email header information is displayed in the eAlerts page and eQuarantine page in the Email Security — Server Web UI.

Parse HTTPS URLs

Whether the option to parse HTTP links is enabled.

Invoke Email Feature Extractor

Whether email feature extraction is enabled. When you enable email feature extraction, the Email Security — Server appliance can scan the header and parts of the message body and extract the email features.

Enable Notice (tap mode)

A notification message is sent to the recipient if a malicious email was detected in Tap/Span mode.

Enable Notice (block mode)

A block notification message is sent to the list of recipients when the Email Security — Server appliance is deployed in block mode.

Block notice from

The From email address header of a block notification message.

Block notice subject

The Subject header of a block notification message.

Block Admin Recipient(s)

Administrators are added to the list of recipients to receive the block notification message.

Block BCC Recipient(s)

Bcc recipients are added to the list of recipients to receive the block notification message.

TypoSquatting

Whether the typosquatting detection feature is enabled. When you enable typosquatting detection, the appliance can analyze suspicious sender and URL domains used in URLs within an email message body.

Monitoring Enabled

Whether the monitor policy is enabled.

Monitoring Interval (min)

Monitor alert interval period in minutes.

Monitoring Bypass Threshold

Monitor alert bypass threshold limit.

Monitoring Deferred Threshold

Monitor alert threshold limit in the deferred queue.

Monitoring Backoff (sec)

Monitor alert backoff period in seconds.

Text Attachment Analysis

Whether the option to submit an ASCII text attachment for analysis is enabled.

Image Analysis

Whether the option to submit an image attachment for analysis is enabled.