Understanding Email Headers with analysis status

Prev Next

After analyzing the email attachment/URL for threats, Intelligent Sandbox updates adds these headers of the respective emails with the observations, and sends the emails to the configured relay host.

Header

Values

X-ATD-FILENAMES

Lists the names of all attachments/URLs of the email separated by comma(,).

X-ATD-ALTFILENAMES

Lists the alternate names of scanned attachments that have the same hash value as determined during the earlier scans. For example, if after scanning a file (file1), another attachment with the same hash but a different file name (file2) is detected, the X-ATD-ALTFILENAMES header is added with the value file1, file 2.

X-ATD-FILEHASHES

Adds the hashes of all email attachments/URLs. For example, MD5 , SHA-256.

X-ATD-FILEVERDICTS

Adds the verdict for each email attachment/URL that was submitted for analysis.

  • 5 — Very high (risk)

  • 4 — Malicious

  • 3 — Likely to be malicious

  • 2 — Low activities

  • 1 — Very low activity

  • 0 — Informational

  • -1 — Clean

  • -2 — Failed to scan (because of unsupported file type)

  • -3 — Scan Timed out

  • -4 — Filtered by the File Type Configuration

  • -5 — Filtered by File Filtering Rules

X-ATD-VERDICT

Adds the overall verdict for an email.

  • 5 — Very high (risk)

  • 4 — Malicious

  • 3 — Likely to be malicious

  • 2 — Low activities

  • 1 — Very low activity

  • 0 — Informational

  • -1 — Clean

  • -2 — Failed to scan (because of unsupported file type)

  • -3 — Scan timed out

  • -6 — No file attachments were scanned

  • -7 — Silent Mode (When Intelligent Sandbox is set to disable file scanning, where the emails attachments are not scanned and only email count is incremented for every email)

  • -8 — Intelligent Sandbox is too busy to service new scanning requests. At least one attachment has not been scanned and does not have a cached result (see X-ATD-TOOBUSY)

  • -100 — Intelligent Sandbox failed to receive or deliver the emails

X-ATD-SILENTMODE

Adds the value of 1 if an email was scanned in silent mode. Otherwise this header is not added.

X-ATD-TOOBUSY

Adds this header to all messages that pass through Intelligent Sandbox while it is:

  • processing new attachments/URLs for scanning

  • configured in Email pass-through mode.