When an email that contains an attachment matches whitelist or blacklist rules on the Malware Analysis appliance, you can view the results on the Search Emails > Processed Mails page using the Web UI.
The Search Emails > Processed Mails page lists emails that contain an attachment and match the signature ID, SHA-256 hash file, or URL entries that you added to the custom whitelist with the verdict "Clean" and status "Sent" or "Delivered". The Search Emails > Processed Mails page lists emails that contain an attachment and match the SHA-256 hash file or URL entries that you added to the custom blacklist with the verdict "Malicious" and status "Quarantined". The malicious emails are also listed on the Email Quarantine page. For details about the email quarantine, see About the email quarantine on .
The following example displays emails that match custom blacklist and whitelist rules based on the SHA-256 hash file on the Search Emails > Processed Emails page.
.png)
For details about how to view the list of malicious and non-malicious emails that have been processed, see Viewing and exporting the results of processed emails.
Note
You can view the status of the emails that have been processed only using the Web UI.
Prerequisites
Administrator or Operator access to the Malware Analysis appliance.
An established connection between your Malware Analysis appliance and the Internet.
The appliance database contains one or more custom whitelist and blacklist rules.