Ability to consume External Threat Feeds

You can now configure your Cisco Email Security appliance to consume external threat information in STIX format communicated over TAXII protocol.

The ability to consume external threat information in the Cisco Email Security appliance, helps an organization to:

• Proactively respond to cyber threats such as, malware, ransomware, phishing attacks, and targeted attacks.

• Subscribe to external threat feeds or other devices on your organization's network that is capable of fetching external threat feeds in STIX format communicated over a TAXII protocol, and consume the threat information in your appliance.

• Import dynamic information (for example, a dynamic list of URLs) in your appliance and configure mail policies or define message actions based on the dynamic information.

• Improve the efficacy of the Cisco Email Security appliance.

If you are using the Classic licensing mode and you do not have an External Threat Feeds feature key, you must contact the Cisco Global Licensing Operations (GLO) team to obtain the feature key as follows:

1. Send an email to the GLO team (licensing@cisco.com) with the message subject as “Request for External Threat Feeds Feature Key”, and provide your Product Authorization Key (PAK) file and Purchase Order (PO) details in the email.

2. The GLO team provisions the feature key manually, and sends you an email with the license key to install on your appliance.

For more information, see Configuring Email Gateway to Consume External Threat Feeds and the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances.

Filtering Messages using Sender’s Domain Reputation

Cisco Sender Domain Reputation (SDR) is a cloud service that provides a reputation verdict for email messages based on a sender’s domain and other attributes

The domain-based reputation analysis enables a higher spam catch rate by looking beyond the reputation of shared IP addresses, hosting or infrastructure providers, and derives verdicts based on features associated with fully qualified domain names (FQDNs) and other sender information in the SMTP conversation and message headers. For more information about SDR, contact Cisco Talos Security Intelligence and Research Group (Talos) at https://www.talosintelligence.com.

For more information, see Sender Domain Reputation Filtering and the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances..

Enhancing User Experience using How-Tos Widget

The How-Tos is a contextual widget that provides in-app assistance to user in the form of walkthroughs to accomplish complex tasks on your appliance.

The following are the walkthroughs that are supported for this release:

• Verifying Incoming Messages using DMARC.

• Verifying Incoming Messages using SPF/SIDF.

• Verifying Incoming Messages using DKIM.

• Enabling and Configuring Graymail Engine on the Email Security Gateway.

• Enabling and Configuring Outbreak Filters on the Email Security Gateway.

• Detecting macro-enabled attachments in messages.

For more information, see the Accessing the Appliance and the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances.

Support for Cisco AMP Threat Grid Clustering for File Analysis

You can now add standalone or clustered Cisco AMP Threat Grid appliances for file analysis in any one of the following ways:

• Security Services > File Reputation and Analysis page in the web interface. See the File Reputation Filtering and File Analysis.

• ampconfig command in the CLI. See the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances.

Configuring Threshold Settings for File Analysis

You can now set the upper threshold limit for the acceptable file analysis score.

The files that are blocked based on the Threshold Settings are displayed as Custom Threshold in the Incoming Malware Threat Files section of the Advanced Malware Protection report.

For more information, see File Reputation Filtering and File Analysis.

Viewing malicious messages based on the threat name

In Message Tracking, you can now search for incoming or outgoing messages detected as malicious by the AMP engine based on the threat name.

For more information, see Tracking Messages.

DNS-based Authentication of Named Entities (DANE) support for Outgoing TLS Connections

You can now securely send messages to a valid recipient domain by enabling DNS-based Authentication of Named Entities (DANE) for your outgoing TLS connections on your appliance.

The ability to securely send messages to the valid recipient domain helps an organization to ensure that business critical and confidential information is delivered to the intended recipient, provided the destination domain supports DANE.

For more information, see Encrypting Communication with Other MTAs.

Support for Smart Software Licensing

Smart Software Licensing enables you to manage and monitor Cisco Email Security appliance licenses seamlessly. To activate Smart Software licensing, you must register your appliance with Cisco Smart Software Manager (CSSM), which is the centralized database that maintains the licensing details of all the Cisco products that you purchase and use.

The following are the advantages when you switch from the Classic Licensing mode to the Smart Licensing mode on your appliance:

• You can handle the Product Authorization Key (PAK) licenses between the physical and virtual appliances easily, which was difficult in the Classic Licensing mode.

• You can easily migrate the software licenses between devices or virtual accounts in your organization.

• You do not need to manage or keep a copy of the PAK files on your appliance.

• You can restrict the user access on the Smart Licensing account.

For more information, see System Administration and the CLI Reference Guide for AsyncOS for Cisco Email Security Appliances.