Best Practice Guide for Anti-Spam, Anti-Virus, Graymail and Outbreak Filters

• On the ESA, navigate to Security Services> IMS and Graymail
• Click the Enablebutton on IMS Global Settings:

• Look for Common Global Settings and click Edit Global Settings
• Here you can configure multiple settings. The recommended settings are shown in the image below:

• Click Submitand Commit your changes.

If you do not have an IMS license subscription:

• Navigate to Security Services > IronPort Anti-Spam
• Click the Enablebutton on IronPort Anti-Spam Overview
• Click Edit Global Settings
• Here you can configure multiple settings. The recommended settings are shown in the image below:

• Cisco recommends selecting Aggressive Scanning Profile for a customer who desires a strong emphasis on blocking spam.
• Click Submitand Commit your changes

Enable centralized spam quarantine

Since Anti-Spam has the option to be sent to quarantine, it is important to ensure that the spam quarantine is set up:

• Navigate to Mail Policies > Incoming Mail Policies
• The Incoming Mail Policies use IronPort Anti-Spam settings by default.
• Clicking the blue link under Anti-Spam will allow for that particular policy to use customized Anti-Spam settings.
• Below you will see an example that shows the Default Policy using customized Anti-Spam settings:

Customize Anti-Spam settings for an Incoming Mail Policy by clicking the blue link under Anti-Spam for the policy you wish to customize.

Here you can select the Anti-Spam Scanning option you wish to enable for this policy. 

• For the purposes of this best practice document, click the radio button next to Use IronPort Intelligent Multi-Scan:

The next two sections include Positively-Identified Spam Settings and Suspected Spam Settings:

• The recommended best practice is to configure Quarantine action on Positively-Identified Spam setting with the prepended text [SPAM] added to the subject and;
• Apply to Deliver as the action for Suspected Spam Settings with the prepended text [SUSPECTED SPAM] added to the subject:

• Spam Threshold setting can be changed, and the recommended settings are to customize the Positively-Identified Spam score to 90 and the Suspected Spam score to 43:

• Click Submitand Commit your changes

• On the ESA, navigate to Security Services> IMS and Graymail
• Click the Edit Graymail Settingsbutton on Graymail Global Settings
• Select all options - Enable Graymail Detection, Enable Safe Unsubscribe and Enable Automatic Updates:

• Click Submitand Commit your changes

• Navigate to Mail Policies > Incoming Mail Policies
• Clicking the blue link under Graymail will allow for that particular policy to use customized Graymail settings.
• Here you can select the Graymailoptions you wish to enable for this policy. 
• For the purposes of this best practice document, click the radio button next to Enable Graymail Detection for This Policy and Enable Graymail Unsubscribing for This Policy:

The next three sections include Action on Marketing Email Settings, Action on Social Network Email Settings and Action on Bulk Email Settings.

• The recommended best practice is to enable all of them and remain the action as Deliver with prepended text added to the subject in respect to the categories as shown below:

• Click Submitand Commit your changes

Outgoing Mail Policy should have Graymail remain in Disabled condition.

Outbreak Filters

Outbreak Filters combine triggers in the Anti-Spam engine, URL scanning and detection technologies and more to correctly tag items that fall outside the true spam category – for example, phishing emails and scam emails and handles them appropriately with user notifications or quarantine.

Verify feature key

• On the ESA, navigate to System Administration > Feature Keys
• Look for Outbreak Filters and make sure it is active.

Enable Outbreak Filters service

Configure Outbreak Filters in policies

• Navigate to Mail Policies > Incoming Mail Policies
• Clicking the blue link under Outbreak Filters will allow for that particular policy to use customized Outbreak Filters settings.
• For the purposes of this best practice document, we keep the Outbreak Filter Settings with default values:

• Outbreak Filters can rewrite URLs if they are deemed malicious, suspect, or phish. Select Enable message modification to detect and rewrite URL based threats.
• Make sure the URL Rewriting option is Enable for all messages as following shown:

• Click Submitand Commit your changes

Outgoing Mail Policy should have Outbreak Filters remain in Disabled condition.

Conclusion

This document aimed to describe the default, or best practice configurations for Anti-Spam, Anti-Virus, Graymail and Outbreak Filters in the Email Security Appliance (ESA). All of these filters are available on both the inbound and outbound email policies, and configuration and filtering are recommended on both – while the bulk of the protection is for inbound, filtering the outbound flow provides protection against relayed emails or internal malicious attacks.