Administration Guide Revision E. SaaS Protection

Transcription

1 Administration Guide Revision E SaaS Protection

2 COPYRIGHT Copyright 2015 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, , TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 SaaS Protection Administration Guide

3 Contents Preface 7 About this guide Audience Conventions What's in this guide Find McAfee SaaS service documentation Protection 9 2 Overview 11 Overview page Display Statistics view Quarantine 15 Search quarantine messages Quarantine page Safe Message View Continuity 17 Continuity features and limitations Open an in Continuity Search for mail in Continuity Compose an in Continuity Continuity Continuity for non-local accounts Policies 27 Policies page New Policy Set window Managing Policy Sets Details Details tab Virus Configure actions to take against a virus Virus actions Notifications [Virus] Spam What is spam? Configure the spam classification policy Classification Configure content groups policies Content Groups subtab Reporting tab ClickProtect Update ClickProtect options for an inbound policy set SaaS Protection Administration Guide 3

4 Contents Classification tab Custom Warnings tab Allow List tab Content Content groups Custom content groups Registered Documents Notifications [Content] HTML Shield tab Attachments File Types Attachment File Types Filename Policies Additional policies Notifications [Attachments] Allow/Deny Sender allow Sender Deny Recipient Shield Authentication Enforced TLS Enforced SPF Enforced DKIM Notifications [ Authentication] Notifications Configure a notification template Notifications tab Notification variables Disaster Recovery Group Subscriptions Add a group subscription Setup 77 Inbound Servers Verify setup of inbound servers Set up an inbound server Delete an inbound server Inbound Servers page Outbound Servers Configuring outbound filtering Configure outbound servers Delete an outbound server Outbound Servers Setup page Outbound Disclaimer Add an outbound disclaimer Outbound Disclaimer page Disaster Recovery Disaster recovery services Set up automatic spooling for disaster recovery Start and stop spooling for disaster recovery manually Set up notifications of disaster recovery Disaster Recovery page MX records Redirecting your MX Records Select a region to review MX records MX Records Setup page SaaS Protection Administration Guide

5 Contents User Creation Settings page Registered Documents How registering documents prevents distribution of proprietary documents Upload a registered document Registered Documents page DKIM Setup Set up DKIM DKIM Setup page Message Audit 93 Viewing message disposition information Search by message details Search by Message ID Search by header Message audit Audit Details Preview event definitions Viewing blocked IP addresses Run a Perimeter Block Search Perimeter Block Search window Viewing Search History Review Search History Search History window Reports 105 Reports overview Set up your customer or domain and time zone Traffic Overview report Traffic: TLS report Traffic: Encryption report Threats: Overview report Threats: Viruses report Threats: Spam report Threats: Content report Threats: Attachments report Enforced TLS: Details report Enforced SPF report Enforced DKIM report ClickProtect: Overview report ClickProtect: Click Log report Quarantine: Release Overview report Quarantine: Release Log report User Activity report Event Log report Audit Trail report Inbound Server Connections report Disaster Recovery: Overview report Disaster Recovery: Event Log report Index 123 SaaS Protection Administration Guide 5

6 Contents 6 SaaS Protection Administration Guide

7 Preface This guide provides the information you need to configure, use, and maintain your McAfee SaaS service. Contents About this guide Find McAfee SaaS service documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee SaaS documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who configure and manage specific features of a service. Conventions This guide uses the following typographical conventions and icons. Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis. Bold User input or Path Code Text that is strongly emphasized. Commands and other text that the user types; the path of a folder or program. A code sample. User interface Hypertext blue Words in the user interface including options, menus, buttons, and dialog boxes. A live link to a topic or to a web site. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. SaaS Protection Administration Guide 7

8 Preface Find McAfee SaaS service documentation What's in this guide This guide is organized to help you find the information you need. It's divided into functional parts intended to support the goals you need to accomplish when using your McAfee SaaS service. Each part is further divided into chapters that group relevant information together by feature and associated tasks, so you can go directly to the topic you need to successfully accomplish your goals. Find McAfee SaaS service documentation McAfee provides the information you need during each phase of service implementation, from setup to daily use and troubleshooting. After a service update is released, information is added to the McAfee SaaS and Web Security Support site. Task 1 Go to the ServicePortal for SaaS and Web Security page at 2 Click or select Downloads. 3 Under Reference Materials, scroll down to access information that you need: Service Enhancements and Release Notes Training Materials Service Reference Guides 8 SaaS Protection Administration Guide

9 1 1 Protection Protection provides security services that safeguard corporations from unsolicited spam , junk mail, viruses, worms, and unwanted content at the network perimeter before they can enter your internal network. Multiple layers of Protection provide secure and complete filtering to protect your users. You can enable or disable specific layers by changing the licensed packages of features or through configuring the specific policies in the Control Console. SaaS Protection Administration Guide 9

10 1 Protection 10 SaaS Protection Administration Guide

11 2 Overview The Overview page provides high-level information about traffic to your domain over the last 24 hours. By default, the page displays Disaster Recovery Current Status and Disaster Recovery Activity. Contents Overview page Display Statistics view Overview page Use the Overview page to view status information for Disaster Recovery, as well as the 24 hour snapshot. Table 2-1 Overview page options Overview Display Statistics Definition Click the Overview tab to view the default information. Disaster Recovery Current Status Disaster Recovery Activity Click the Display Statistics button to view the snapshot information. Statistics for last 24 hours are based on your local time zone. Inbound 24 Hour Snap Shot Outbound 24 Hour Snap Shot Traffic (Last 24 hours - time zone) Policy Enforcement (Last 24 Hours - time zone) Disaster Recovery Current Status Disaster Recovery Activity SaaS Protection Administration Guide 11

12 2 Overview Display Statistics view Display Statistics view Click Display Statistics to view the 24-hour snapshot of inbound and outbound traffic. Table 2-2 Display Statistics view Inbound 24 Hour Snap Shot Outbound 24 Hour Snap Shot Traffic (Last 24 Hours) Policy Enforcement (Last 24 Hours) Definition Displays a 24-hour snapshot of inbound traffic: Bandwidth Average bandwidth used by inbound messages. Avg Size Average size of inbound messages, including attachments. Denied Messages refused because they contain a virus, unwanted content, attachments, HTML, bounces or are probably spam. Delivery is denied. Content All inbound s that violated the content keyword policies. Virus Number of inbound s that contained viruses. Messages Number of inbound messages processed. This number includes messages sent to all domains for the customer. Quarantined Total number of inbound s that were quarantined for any reason including spam, virus, etc. Attachment All inbound s that had attachments that violated the attachment policies. Spam Number of inbound s that were potentially spam. Displays a 24-hour snapshot of outbound traffic: Bandwidth Average bandwidth used by outbound messages. Avg Size Average size of outbound messages, including attachments. Denied Messages refused because they contain a virus, unwanted content, attachments, HTML, bounces or are probably spam. Delivery is denied. Attachment All outbound s that had attachments that violated the attachment policies. Virus Number of outbound s that contained viruses. Messages Number of outbound messages processed. This number includes messages sent from all domains and all users for the customer, even when users send messages from domains not actually administered for the customer (for example, messages from gmail accounts). Quarantined Total number of outbound s that were quarantined for any reason, including spam, virus, and so on. Encrypted All outbound s that violated any encrypted policies. Content All outbound s that violated the any content keyword policies. Displays a graphical representation of traffic volume within the last 24 hours of the designated time zone that displays the total number of inbound and outbound s. Displays the percentage of messages that had the different actions applied (for example, stripped, blocked, tagged, quarantined, cleaned, or normally delivered) over the past 24 hours of the designated time zone. 12 SaaS Protection Administration Guide

13 Overview Display Statistics view 2 Table 2-2 Display Statistics view (continued) Disaster Recovery Current Status Disaster Recovery Activity Definition Displays a list of domains that are currently in disaster recovery. Protection is currently spooling the specified domain's . Displays a snapshot of spooled and unspooled messages if your company is in disaster recovery mode. The number of messages is listed, along with the total KB size that is spooled or unspooled. Choose from one of the three mechanisms provided that allows you into the Web Protection system. The default for the time zone is mountain time. SaaS Protection Administration Guide 13

14 2 Overview Display Statistics view 14 SaaS Protection Administration Guide

15 3 Quarantine The quarantine feature in Protection allows you to review suspicious messages and determine whether or not they are spam. Contents Search quarantine messages Quarantine page Safe Message View Search quarantine messages Use the search options to filter quarantined messages and take action as necessary. To change customers, select the link in the upper right of the opened window. In the Select Customer pop-up, enter the name of the customer and select the name when the list of options updates. Task For option definitions, click Help in the interface. 1 In Protection, select Quarantine. 2 Select your Search Criteria. 3 Click Search. Review the results and take actions on quarantined messages as necessary. Quarantine page The Quarantine tab allows you to search quarantined s and review, release, allow, or delete them for users as necessary. Table 3-1 Search Criteria option definitions Definition Domain To From Threat Specifies the domains included in the search. Select to filter by domain. Specifies the recipient's address to use in the search. You can use wildcards to search for multiple addresses that match part of the address. Specifies the sender's address to use in the search. You can use wildcards to search for multiple addresses that match part of the address. Specifies the threat type to use in the search. SaaS Protection Administration Guide 15

16 3 Quarantine Safe Message View Table 3-1 Search Criteria option definitions (continued) Definition Day Direction Specifies the date to use in the search. Specifies the direction of the traffic to use in the search (inbound, outbound, or both). Table 3-2 Search Results option definitions Release Always Allow for User Delete Delete All View Search Results list Definition Click to release the selected messages. Click to add the selected senders to the user's Allow list and release the messages (applies to spam messages only). Click to delete the selected messages. Click to delete all messages. Click to view a message in the Safe Message View tab. Date Displays the date of the message. From Displays the from address of the message. To Displays the to address of the message. Subject Displays the subject of the message. Threat Displays the threat type of the message. Score Displays the quarantine score of the message. Size Displays the size of the message. Safe Message View The Safe Message View window provides more information about the quarantined message you have selected. You can also view the message content when policy settings Safe Message View is enabled. Table 3-3 Safe Message View Release Delete Always Allow for User Always Deny Definition Click to release a selected message from the quarantine list and have it moved to your inbox. Click to delete a selected message from the quarantine list. Click to release messages through to the recipients. All senders' addresses are added to the recipient's Allow List. All future messages from the senders will no longer be quarantined. Click to block messages to the recipients. 16 SaaS Protection Administration Guide

17 4 4 Continuity Continuity provides a comprehensive managed disaster recovery service that protects your traffic during a network outage. When active, users and administrators can view, send, and manage their using the online interface while the service stores all inbound and outbound mail activity in the cloud. Afterwards, when connectivity is restored, the service synchronizes your with your servers and normal use can resume. Contents Continuity features and limitations Open an in Continuity Search for mail in Continuity Compose an in Continuity Continuity Continuity for non-local accounts SaaS Protection Administration Guide 17

18 4 Continuity Continuity features and limitations Continuity features and limitations You can use most of the features of a standard web client during an outage. Table 4-1 Continuity features and limitations features... That you can use during an outage That are unavailable during an outage That may be different from your standard client Description Standard options. Attach files Search messages Cannot change your From: address. No access to your Global Address List or Personal Contact List. These Distribution Lists are on the corporate server, and during an outage, the corporate server is not available. No Spell Check. No Drafts Folder. No "Check names" functionality to verify address prior to sending. Cannot search for text in the body of a message. You must separate multiple addresses with commas, no spaces after the comma. You must enter a fully qualified address in the To: field when composing a new message. If you have opened several messages, a tab for each message will appear. Messages deleted in Continuity are not permanently deleted. Once your outage is over, all activity is synchronized with your organization's server(s), which handles final message disposition. Open an in Continuity When Disaster Recovery is active, use Continuity tab to access your messages. Task For option definitions, click Help in the interface. 1 Click the Continuity tab. 2 In the Criteria panel, select a mail folder. The tab for the mail folder opens. 3 In the list, select an message. 4 Click Open. The message opens in a new tab. Use the options to respond to the message, delete it, or print it. 18 SaaS Protection Administration Guide

19 Continuity Search for mail in Continuity 4 Search for mail in Continuity When Disaster Recovery is active, use the Continuity tab to search for your messages. Task For option definitions, click Help in the interface. 1 Click the Continuity tab. 2 In the Criteria panel, select a mail folder. The tab for the mail folder opens. 3 Click the Search panel. The search criteria options open. 4 Enter one or more search criteria. 5 Click the Search button. Your search results display in a new tab. Use the options to manage the s in your search results. Compose an in Continuity When Disaster Recovery is active, use the Continuity tab to access your messages. Task For option definitions, click Help in the interface. 1 Click the Continuity tab. 2 In the Criteria panel, select Inbox. The Inbox tab opens. 3 Click the New. The New Message tab opens. 4 Create your . Select your sender address Add recipients Description Select from the From drop-down list. Enter addresses in the To, Cc, or Bcc fields. Enter your subject Attach files 1 Click Attach File to add an Attachment field. 2 Click Browse to select a file. Compose your message Enter the text of your message. In the default view, use the HTML options to format your text. SaaS Protection Administration Guide 19

20 4 Continuity Continuity Description Click Switch to Plain Text to create a message without HTML formatting. 5 Click Send. Your message sends to your recipients. The message appears in the Sent Items folder. Continuity When Disaster Recovery is active, you can access your from the console. Use these tools to receive s, reply to messages, view attachments, and search available folders. Table 4-2 Criteria Search Reset Mail Folders Search for Mail Definitions Click to run a search in the selected mail folder using your selected criteria and dates. Click to reset the search criteria values. Select a folder to view your messages and search for mail. Inbox Click to view your inbox. Deleted Items Click to view your deleted mail. Sent Items Click to view your sent items. Select to run a new search. Criteria Enter a string to search for values in the To, From, and Subject fields. Start Date Enter or select a date value. End Date Enter or select a date value. 20 SaaS Protection Administration Guide

21 Continuity Continuity 4 Table 4-3 Continuity Inbox Deleted Items Definitions New Click to compose a new . Open Click to open the selected in a new tab. Preview Click to view the selected in the preview panel. Select the location of the preview panel, or click the button to cycle through the options. Bottom View the message on the bottom of the tab. Right View the message on the right of the tab. Hide Hide the preview. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Delete Click to delete the selected and move it to the Deleted Items folder. Actions Select an action. Mark as read Click to select messages as read. Mark as unread Click to select messages as unread. Print Click to print the selected . Refresh Click to refresh the list of the messages. Open Click to open the selected in a new tab. Preview Click to view the selected in the preview panel. Select the location of the preview panel, or click the button to cycle through the options. Bottom View the message on the bottom of the tab. Right View the message on the right of the tab. Hide Hide the preview. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Undelete Click to undelete the selected and move it to the Inbox folder. Actions Select an action. Mark as read Click to select messages as read. Mark as unread Click to select messages as unread. Print Click to print the selected . Refresh Click to refresh the list of the messages. SaaS Protection Administration Guide 21

22 4 Continuity Continuity Table 4-3 Continuity (continued) Sent Items Preview panel Definitions Open Click to open the selected in a new tab. Preview Click to view the selected in the preview panel. Select the location of the preview panel, or click the button to cycle through the options. Bottom View the message on the bottom of the tab. Right View the message on the right of the tab. Hide Hide the preview. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Print Click to print the selected . Refresh Click to refresh the list of the messages. Open Click to open the selected in a new tab. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Delete Click to delete the selected and move it to the Deleted Items folder. Actions Select an action. Mark as read Click to select messages as read. Mark as unread Click to select messages as unread. Print Click to print the selected . Show Headers/Hide Headers Click to show or hide headers. 22 SaaS Protection Administration Guide

23 Continuity Continuity for non-local accounts 4 Table 4-3 Continuity (continued) Opened message tab New Message Definitions Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Print Click to print the selected . Show Headers/Hide Headers Click to show or hide headers. Send Click to send the message. Attach Click to attach files to the . Switch to Plain Text/Switch to HTML Click to select the message format. Plain text use text-only format. HTML use HTML WYSIWYG tool to format the message. From: Select the from address. To: Enter one or more addresses. Cc: Enter one or more Cc addresses. Bcc: Enter one or more Bcc addresses. Subject: Enter the subject text. Attachment: Select a file attachment. A new Attachment field displays each time you click Attach and add the file. Delete icon Click to delete the attachment. Message body Enter the message body. Continuity for non-local accounts When Disaster Recovery is active, administrators can view orphaned messages that belong to unassigned users. Table 4-4 Criteria Search Reset Mail Folders Search for Mail Definitions Click to run a search in the selected mail folder using your selected criteria and dates. Click to reset the search criteria values. Select a folder to view your messages and search for mail. Inbox Click to view your inbox. Deleted Items Click to view your deleted mail. Select to run a new search. Criteria Enter a string to search for values in the To, From, and Subject fields. Start Date Enter or select a date value. End Date Enter or select a date value. SaaS Protection Administration Guide 23

24 4 Continuity Continuity for non-local accounts Table 4-5 Continuity Inbox Deleted Items Definitions Open Click to open the selected in a new tab. Preview Click to view the selected in the preview panel. Use the drop-down menu to select the location of the preview panel, or click the button to cycle through the options. Bottom View the message on the bottom of the tab. Right View the message on the right of the tab. Hide Hide the preview. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Delete Click to delete the selected and move it to the Deleted Items folder. Actions Select an action. Mark as read Click to select messages as read. Mark as unread Click to select messages as unread. Print Click to print the selected . Refresh Click to refresh the list of the messages. Go to User List click to return to the user accounts list. Available from the Account Management Users Non-Local Accounts link. Open Click to open the selected in a new tab. Preview Click to view the selected in the preview panel. Use the drop-down menu to select the location of the preview panel, or click the button to cycle through the options. Bottom View the message on the bottom of the tab. Right View the message on the right of the tab. Hide Hide the preview. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Undelete Click to undelete the selected and move it to the Inbox folder. Actions Select an action. Mark as read Click to select messages as read. Mark as unread Click to select messages as unread. Print Click to print the selected . Refresh Click to refresh the list of the messages. 24 SaaS Protection Administration Guide

25 Continuity Continuity for non-local accounts 4 Table 4-5 Continuity (continued) Preview panel Opened message tab Definitions Open Click to open the selected in a new tab. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Delete Click to delete the selected and move it to the Deleted Items folder. Actions Select an action. Mark as read Click to select messages as read. Mark as unread Click to select messages as unread. Print Click to print the selected . Show Headers/Hide Headers Click to show or hide headers. Reply Click to write a reply to the sender of the selected . Reply All Click to write a reply to the sender and all recipients of the selected . Forward Click to forward the selected . Print Click to print the selected . Show Headers/Hide Headers Click to show or hide headers. SaaS Protection Administration Guide 25

26 4 Continuity Continuity for non-local accounts 26 SaaS Protection Administration Guide

27 5 Policies In Protection, policies define rules for filtering your inbound and outbound . Inbound policies protect you from spam, viruses, and other harmful content. Outbound policies, on the other hand, ensures the safety and appropriateness of s being sent from your system. The service includes a default inbound and outbound policy for each of your domains. You can also create custom policies for any domain or group. Contents Policies page New Policy Set window Managing Policy Sets Details Virus Spam ClickProtect Content Attachments Allow/Deny Authentication Notifications Disaster Recovery Group Subscriptions Policies page The Policies page allows you to configure inbound and outbound policy sets. Table 5-1 Policies tab options Inbound Policies Outbound Policies Definition Displays the list of inbound policy sets. Select to configure inbound policies for a domain or group. Displays the list of outbound policy sets. Select to configure outbound policies for a domain or group. SaaS Protection Administration Guide 27

28 5 Policies New Policy Set window Table 5-2 Inbound and Outbound Policies page options Definition Policies toolbar Apply Click to save changes to a policy. Reset Click to restore previously saved changes. New Click to create a new policy. Edit Click to edit an existing policy. Delete Click to delete an existing policy. Policies list Name Specifies the name of the policy. Owner Specifies whether the policy belongs to a customer or a group. Priority Specifies the priority order that the policy is applied in relation to other policies. Description Specifies the description of the policy. New Policy Set window Create a new policy set to apply custom filtering rules to a customer or group. Table 5-3 New Policy Set window options Save Cancel Name Priority Direction Description Owner Copy From Definition Click to save changes. Click to close the window without saving changes. Enter a name for the policy. Displays the priority order of the policy. Displays whether the policy is for Inbound or Outbound SMTP. Enter a brief description of the policy. Select the owner to specify who can edit the policy: Customer Specifies that customer administrators and higher can edit the policy. Group Specifies that group administrators for the specified group as well as customer administrators and higher can edit the policy. Select the group from the drop-down. If necessary, select an existing policy to copy configuration settings into the new policy set. The following options apply for inbound options: Copy Sender Allow List Select to copy the current sender allow list. Copy Sender Deny List Select to copy the current sender deny list. Copy Recipient Shield List Select to copy the current recipient shield list. Copy ClickProtect Allow List Select to copy the current ClickProtect allow list. 28 SaaS Protection Administration Guide

29 Policies Managing Policy Sets 5 Managing Policy Sets Policy sets allow you to define custom inbound and outbound rules for each or your domains, as well as default rules that apply to all domains. Table 5-4 Policy set options Tab Description Inbound Outbound Details Virus Specifies the name, priority, direction, owner, and description of the policy set. Specifies the actions to take and the notifications to send when a message is infected with a virus. Spam Specifies what to do when a message is identified as spam. Yes No ClickProtect Content Specifies ways to protect against web addresses in messages that may link to harmful sites. Specifies filtering rules for specific types of content that may be inappropriate or offensive. Attachments Specifies the filtering rules for attachments. Yes Yes Allow/Deny Authentication Notifications Disaster Recovery Specifies lists of senders who are automatically allowed or denied. Specifies lists of domains that should be verified using TLS, SPF, or a DKIM signature before is sent or received. Specifies options for the notifications that are sent when a policy violation occurs and action is taken. Specifies rules when an interruption occurs and Continuity is available. Group Subscriptions Specifies the list of groups that are affected by this policy. Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes No Yes Yes No Details The Details tab displays the basic set up information for an existing policy set. Details tab View and edit the name and description for the policy set. Table 5-5 Details tab option definitions Save Cancel Name Priority Direction Owner Description Definition Click to save changes. Click to reset without saving changes. Specifies the name of the policy. Specifies the priority order of the policy (read only). Specifies whether the policy is for Inbound or Outbound SMTP (read only). Specifies who can edit the policy (read only). Specifies the brief description for the policy. SaaS Protection Administration Guide 29

30 5 Policies Virus Virus Protection provides highly effective, organization-wide virus and worm protection. By identifying viruses and worms on your network perimeter before they enter or leave your messaging infrastructure, Protection minimizes outbreak and infection risks to your system. Protection virus protection: Provides maximum protection using multiple, industry-leading, anti-virus engines to allow Protection to customize the protection to meet the latest threats. Defines virus definition updates every 5 minutes, providing up-to-the-minute defense against the latest threats. Provides safe, external virus scanning and quarantine management for protection against viruses before they reach your network. Protects your users, networks, and data from harm. Configure actions to take against a virus Select options in the Actions subtab to configure how the system reacts if an is received that contains a known virus. Task For option definitions, click Help in the interface. 1 In the policy set, select Virus Actions 2 Under If a Message Contains a Virus field, select the action to take. 3 If you selected, Clean the message, select an additional action under If a Message Cannot be Cleaned. 4 Click Save. Virus actions The Actions subtab allows you to configure whether infected s are quarantined, denied, or stripped of infection. The following table lists the type of configurations available. Table 5-6 definitions Save Cancel Definition Click to save your changes. Click to restore your previously saved values. 30 SaaS Protection Administration Guide

31 Policies Spam 5 Table 5-6 definitions (continued) If a Message Contains a Virus If a Message Cannot be Cleaned Definition Do Nothing Send to the recipient with no filtering or notification (not recommended). Quarantine the message after attachment is stripped Strip the infected attachment from the and send it to the virus quarantine area without notification to the recipient. Text is inserted into the notifying the recipient that an attachment has been stripped. Strip the attachment Strip the infected attachment from the and send it to the recipient. Text is inserted into the notifying the recipient that an attachment has been stripped. Deny Delivery Deny delivery of the message. Clean the message Attempt to remove the virus content and save the remainder of the message. If the clean is successful, the is sent to the recipient with inserted text indicating that the had been cleaned of a virus. If the clean is unsuccessful, the system takes the action you select under If a Message Cannot be Cleaned. Quarantine the message after attachment is stripped Strip the infected attachment from the and send it to the virus quarantine area without notification to the recipient. Text is inserted into the notifying the recipient that an attachment has been stripped. Strip the attachment Strip the infected attachment from the and send it to the recipient. Text is inserted into the notifying the recipient that an attachment has been stripped. Deny Delivery Deny delivery of the message. Notifications [Virus] Use the Notifications subtab to select when notifications of an action are sent to the sender and the recipient of an that is infected by a virus. Table 5-7 Notifications options Save Cancel Sender options Definition Click to save your changes. Click to restore your previously saved values. Specifies that a notification is sent to the sender when a message triggers the selected action. Recipient options Specifies that a notification is sent to the recipient when a message triggers the selected action. Spam Protection provides the most comprehensive and effective spam-blocking product available, blocking 98 percent of spam and providing an industry-leading low false positive rate. is assigned a high or medium likelihood of being spam as appropriate and a separate action can be assigned to each likelihood. SaaS Protection Administration Guide 31

32 5 Policies Spam Contents What is spam? Configure the spam classification policy Classification Configure content groups policies Content Groups subtab Reporting tab What is spam? Spam includes unsolicited and unwanted commercial sent to many addresses that you want to block from your inbox. In some instances, criminals use spam to gather proprietary information or cause harm to your system. Spam of this kind can use various strategies to bypass spam filters, including blacklists and keyword lists. Spam blocking and bounce flood protection Spam Blocking Protection through Real-Time BlackHole Lists (RBLs) and Bounce Flood Protection are two spam protection methods used to block offending IP addresses or messages. Spam protection method Spam Blocking Protection through RBLs Bounce Flood Protection Definition RBLs are used to identify distributed from known spammer IP addresses. RBLs are enabled by default for all new policy sets. This setting ensures the highest level of spam identification and automatically blocks messages from suspect IP addresses. Custom "allow lists" take precedence over RBLs on a per address basis. The address of the sender is always compared to the appropriate allow lists before RBL filtering. The system delivers the message if the address appears on an allow list. Customers can opt out of RBL protection, but, for security purposes, opt out is not recommended. Denies receipt of unrecognized bounce messages but allows valid bounces that contain a secure header provided by the outbound service. Filtering graymail Protection includes a pre-built content policy for easily identifying and blocking graymail. Unlike spam, graymail includes legitimate bulk messages, newsletters, and advertisements. For example, a retailer that you once opted into, but now you want to block. Defining content groups Spam content filtering is controlled by comparing the content of an against predefined lists of keywords or phrases (spam content groups). You can define a different action for each spam content group. The action in this window overrides all other spam actions. For example, an that has a medium likelihood of being spam also contains content that is in a spam content group. In this case, the action defined for the spam content group applies rather than the action for medium spam. 32 SaaS Protection Administration Guide

33 Policies Spam 5 This policy is separate from the Content Keyword filtering controlled by the Content Groups tab. s that are quarantined are placed in the content quarantine area for the user account. This account is accessible only by quarantine managers or higher-level users. When the same content is defined in the Spam tab and in the Content tab, the content policies are used. Configure the spam classification policy Use the spam classification policy settings to automatically manage unwanted s. The different classification levels allow you to select different actions depending on the risk-level of messages. For option definitions, click Help in the interface. Task 1 Under Protection, select Policies and open a policy set. 2 In the policy set window, select Spam Classification. 3 Select an option for each spam likelihood level to specify an action. probably spam (medium likelihood) almost certainly spam (high likelihood) graymail 4 Select additional policy actions as necessary. 5 Click Save. Classification Use the Classification tab to configure your inbound spam policy. Table 5-8 definitions Save Cancel Definition Click to save changes. Click to clear changes. SaaS Protection Administration Guide 33

34 5 Policies Spam Table 5-8 definitions (continued) When a message is Definition probably spam (medium likelihood) Specifies messages that are likely to be spam. Tag the message subject with "[SPAM]" Append "[SPAM]" to messages so you can sort and review them in your local client. Quarantine Store messages in quarantine. Deny delivery Block messages and notify the senders when messages are rejected. Do nothing Accept all messages and take no further action. Do nothing is reported on the Threats: Spam report as Other for spam messages. almost certainly spam (high likelihood) Specifies messages that are the most likely to be spam. Tag the message subject with "[SPAM]" Append "[SPAM]" to messages so you can sort and review them in your local client. Quarantine Store messages in quarantine. Deny delivery Block messages and notify the senders when messages are rejected. Do nothing Accept all messages and take no further action. Do nothing is reported on the Threats: Spam report as Other for spam messages. graymail Specifies messages that are non-spam but can include unwanted subscriptions and other bulk messages. Tag subject with "[Graymail]" Append "[Graymail]" to messages so you can sort and review them in your local client. Quarantine Store messages in quarantine. Deny delivery Block messages and notify the senders when messages are rejected. Do nothing Accept all messages and take no further action. Do nothing is reported on the Threats: Spam report as Other for spam messages. Allow Accept all messages and allow the senders in the future. More s Enable real-time block lists (RBLs) Select for enhanced spam protection that can detect and block IP addresses that are sending mass mailing campaigns. Block unrecognized bounce messages ("backscatter") Select to prevent unrecognized bounce messages from being received. Enable spam flood prevention Select to block high volume, short-lived, spam campaigns, also known as "hailstorm" spam. Deselect to reduce false positives where spam flood prevention is the cause. Configure content groups policies Designate what action to take if an contains any content that is defined as spam content for groups. 34 SaaS Protection Administration Guide

35 Policies Spam 5 Task For option definitions, click Help in the interface. 1 Under Protection, select Policies and open a policy set. 2 In the policy set window, select Spam Content Groups. 3 Click New. 4 Type a unique Group Name for the new content group and configure options. a Enter keywords and phrases associated with the content group in the Content field. b c Select the appropriate Action. For example, Quarantine. Select Enable to apply the content group to the policy. 5 Click Save. Content Groups subtab Use the Content Groups subtab to define content groups and assign the actions to take if an matches those keywords or phrases. Table 5-9 Content Groups option definitions New Edit Delete Definition Click to create a new content group. Click to edit an existing content group. Click to delete a content group. SaaS Protection Administration Guide 35

36 5 Policies Spam Table 5-9 Content Groups option definitions (continued) Content groups table Definition Displays a list of current content groups. Group Name Displays the name of the content group. Action Displays the action to take. Enabled Displays whether the content group is currently enabled. Content groups options Specifies the settings when creating a content group or editing an existing group name. Group Name Specifies the content group name. Content Specifies the keywords or phrases associated with the content group. Action Specifies the action to take. Quarantine Deny Allow Tag subject Enable Select to enable the content group. Save Click to save changes. Cancel Click to close the content group options without saving. You can use wildcards asterisk (*) and question mark (?) to define the content for a content group. The asterisk applies to one or more characters in a string. The question mark applies to a single character. Wildcards can be place within or at the end of a string, but not at the beginning. Reporting tab The Reporting tab allows you to configure the Spam Report. Table 5-10 Reporting option definitions Save Cancel Definition Click to save changes. Click to clear changes. 36 SaaS Protection Administration Guide

37 Policies Spam 5 Table 5-10 Reporting option definitions (continued) Default Settings Schedule and Frequency Definition a Spam Report to Specifies who receives the report. All users assigned to this policy All user accounts associated with the policy set. Selected users Only those user accounts configured for Spam Reports on the user management windows. No users No users associated with this policy set. Format Specifies the format and type of content to include in the Spam Report. HTML - with Actions This HTML report allows the recipient to perform actions directly from the Spam Report. You can Release, Always Allow, or (if allowed) Always Deny each message in the report. You can also Delete All messages in the spam quarantine. HTML - without Actions The HTML Report does not contain any of the action links. Plain text Report is plain text. Type Specifies what should be included in the Spam Report. New Items Since Last Report Contains any new quarantined spam messages added since the last generated report. This does not apply to the on-demand Spam Reports. All quarantined items Contains all quarantined spam messages. Spam Report Links to the Control Console Specifies the number of days links are active before they expire. Two additional values allow you to customize the link: Require authentication The link does not expire but it does require the user to log on. Never expire The link never expires. Custom Message Specifies custom text that you can add to the Spam Report. Text is limited to 4000 characters. Frequency Specifies the days of the week that the report is sent. Select one or more days. Deliver reports by Specifies the time of day that the reports are scheduled to be delivered by. You can schedule Spam Reports to be sent once or twice a day. Reports are sent out no later than the time specified. All times are based on your time zone setting. To set your time zone, select Account Management Customers Details. Select the update link next to Time Zone Default In the pop-up, select your time zone, click Update. SaaS Protection Administration Guide 37

38 5 Policies ClickProtect Table 5-10 Reporting option definitions (continued) Allow users to... Definition personalize spam filtering options When enabled, users can select the actions for spam from the Preferences tab. personalize Spam Report delivery time and frequency When enabled, users can select the frequency of reports from the Preferences tab. personalize report type When enabled, users can change the report type from the Preferences tab. disable spam filtering When enabled, users can turn off spam filtering from the Preferences tab. configure alternate address for spam report delivery When enabled, users can specify their alternate address from the Preferences tab. Redirecting the report allows the alternate recipient to have full access to a user's Control Console account. Encourage users to choose their alternate address carefully. download Spam Control For Outlook When enabled, users can download the Spam Control For Outlook utility. You can specify the location for the download on the branding settings page. Access to Spam Control for Outlook can also be enabled or disabled at the system level. Other s Specifies additional options enabled for reports. Allow non-admin users to login directly to the Control Console When enabled, allows users to log onto the Control Console using the logon page. Does not affect the ability of users to log on by selecting a link in the Spam Report. If Control Console access is not enabled and users do not receive the Spam Report, the quarantine manager or higher-level roles must perform any changes to user settings. Display messages in quarantine using Safe Message View When enabled, allows users to view the body content of an in the safe message view window. Otherwise, the user must release the to see what it contains in the body content. Display user address in the Spam Report When enabled, displays user addresses and aliases in the Spam Report. Enable the "Deny" shortcut from the Spam Report When enabled, displays the Always Deny link in the Spam Report, the Message Quarantine page, and the Safe Message View page. Otherwise, users must go to the Allow/Deny Sender Lists window to change their Allow or Deny lists. Show the spam score on the Spam Report When enabled, displays the spam likelihood score for each quarantined message in the Spam Report. ClickProtect ClickProtect safeguards your organization from web-based threats that can arrive by using McAfee GTI URL Reputation. URLs are evaluated during processing ("scan-time") as well as when 38 SaaS Protection Administration Guide

39 Policies ClickProtect 5 users click a link ("click-time"). Click-time scanning ensures that users are protected from changes to a site's reputation that can occur after the message is initially scanned. Figure 5-1 New ClickProtect tab in the inbound policy window Update ClickProtect options for an inbound policy set Configure ClickProtect to take specific scan-time and click-time actions that protect your users from risky URL links in inbound messages. Task For option definitions, click Help in the interface. 1 Select Protection Policies Inbound Policies 2 Highlight a custom policy or select the Default Inbound policy, click Edit. 3 In the Policy Set window, select ClickProtect. 4 Select Enable ClickProtect. 5 Select scan-time and click-time actions for each reputation type. 6 Under Advanced Anti-malware Scan, select malware scan options as necessary. 7 Click Save. Once ClickProtect is active, you can customize the warning messages your users see as well as update the list of approved URLs. SaaS Protection Administration Guide 39