Improved Efficacy to Detect Threats

Your email gateway is now more secure with:

• Improved HTML parsing and malicious script detection.

• Improved URL parsing and redirection detection.

Perform the following configuration steps to use this feature:

1. Enable the Graymail service engine globally on your email gateway in any one of the following ways:

   Web Interface: Navigate to Security Services > IMS and Graymail page and select the Graymail Detection checkbox under Graymail Global Settings.

   CLI: Use the graymail > setup sub command and type yes for the "Would you like to use Graymail Detection? [Y]>" statement.

2. Enable the Anti-spam service engine for the required incoming mail policy as follows:

   1. Navigate to Mail Policies > Incoming Mail Policies page on the web interface.

   2. Click the Disabled link under 'Anti-Spam' in the 'Policies' field.

   3. Select the Use IronPort Anti-Spam service or Use IronPort Intelligent Multi-Scan option buttons, whichever is applicable, to enable Anti-Spam scanning for the mail policy.

   4. Select the required action - 'deliver,' 'drop,' 'spam quarantine,' or 'bounce,' whichever is applicable, to apply to positively identified spam messages.

   5. [Optional]: Perform any other required Anti-spam configuration settings.

   6. Click Submit and commit your changes.

A new verdict - ThreatScanner Spam Positive is added in Message Tracking and Mail Logs to indicate that the message is categorized as “spam” due to improved threat detection. The recommended Anti-Spam policy action forThreatScanner Spam Positive verdict is Quarantine.

The Graymail logs with Spamcause data are available at Information log levels.

Enforcing TLS for Outgoing Messages at Sender or Recipient Level

The existing Destination Controls configuration allows you to override the TLS modes (such as TLS Mandatory, TLS Preferred, and so on) on a per-domain basis.

If you need to enforce TLS for outgoing messages based on additional conditions such as – senders, recipients, and so on, you can now use the X-ESA-CF-TLS-Mandatory header.

You can configure the "Content Filter – Add/Edit Header" action to add the X-ESA-CF-TLS-Mandatory header in the “Header Name:” field based on any content filter conditions and attach the content filter to an outgoing mail policy.

URL Retrospective Verdict and URL Remediation

The URLs with unknown reputation can turn malicious anytime, even after it has reached the user's mailbox. You can configure URL filtering on your email gateway to send alerts based on the URL retrospective verdicts received from Talos. You can also configure your email gateway to perform auto-remedial actions on the messages in user mailbox when the URL verdict changes from unknown to malicious.

For more information, see Protecting Against Malicious or Undesirable URLs.

Integrating Secure Email Gateway with Threat Defense

The Threat Defense Connector client connects the Secure Email Gateway with the Secure Email Threat Defense to scan messages for Advanced Phishing and Spoofing.

When you configure the Threat Defense Connector, the Secure Email Gateway sends a copy of the actual message as an attachment to the Threat Defense portal’s message intake address. The message gets delivered to the user inbox, and advanced scanning completes in the Threat Defense portal.

You can enable the Threat Defense Connector in any of the following ways:

• From the Security Services > Threat Defense Connector page of the web interface.

• Using the threatdefenseconfig command in the CLI.

For more information, see Integrating Secure Email Gateway with Threat Defense.

File Reputation Service Enhancement

From AsyncOS 15.x release onwards, the email gateway uses a new version of the AMP engine. This new AMP engine uses HTTPS (port 443) instead of TCP to ensure secure communication between your email gateway and Secure Endpoint Cloud.

For more information, see File Reputation Filtering and File Analysis.

Obtaining Configuration Information using AsyncOS APIs

You can use the Configuration APIs to perform various operations (such as create, retrieve, update, and delete) in your email gateway. The various API categories for configuration are:

• Authentication APIs

• URL Lists APIs

• Dictionary APIs

• Host Access Table (HAT) APIs

For more information, see the “Configuration APIs” section in the AsyncOS 15.0 API for Cisco Secure Email Gateway - Getting Started Guide.

Customizing Graymail Unsubscribe Banner

You can customize the following settings of the Graymail Unsubscribe banner based on your organization’s requirements:

• Position of the banner

• Color of the banner

• Text color of the banner message

• Contents of the banner message

The banner message supports the following languages: English (United States), Italian, Chinese, Portuguese, Spanish, German, French, Russian, Japanese, Korean, and Chinese (Taiwan).

For more information, see Customizing Graymail Unsubscribe Banner based on Organizational Requirements.

Removal of Old Splunk Database for Email Tracking Data

[For on-premises users only]: When you upgrade to Secure Email Gateway 15.0 and later, and if the email tracking data is contained in the Splunk database, the system deletes the Splunk database if you proceed with the upgrade.

During the upgrade, a warning message indicating that the system will delete the Splunk database is displayed in the CLI or the web interface of your email gateway.

Following is a sample warning message displayed at the time of the upgrade:

“From Secure Email Gateway 12.1.x version onwards, we have moved to a newer storage system for email tracking data. 
Generally, the old data is replaced with new data in the new storage system automatically. 
However, in some scenarios (for example, 'late upgrades', 'low mail flow' and 'tracking data', and so on), 
there could be traces of old data still present in the old storage system that is no longer supported.
In your case it is, 7.1 MB, which was last updated in 01 Jul 2022.
If you proceed with this upgrade process, the data in the old storage will be removed.
You can choose to proceed with the upgrade or abort the upgrade.
Do you want to proceed with the upgrade?[Y]”

[For cloud users only]:When you upgrade to Secure Email Gateway 15.0 and later, and if the email tracking data is contained in the Splunk database, the system deletes the Splunk database if you proceed with the upgrade.

FIPS Certification

Cisco Secure Email Gateway is FIPS certified and has integrated the following FIPS 140-2 approved cryptographic module: Cisco Common Crypto Module (FIPS 140-2 Cert. #4036).

For more information, see FIPS Management.

Deleting Log Files from Email Gateway

You can now delete log files stored in the /data/pub/directories path of your email gateway.

You can use the logconfig > deletelogfile sub command in the CLI to delete the log files.

For more information, see the “Example - Deleting Log Files” section of the CLI Reference Guide associated with this release.

Generation 2 Deployment Support for Hyper-V Models

From AsyncOS 15.0 release onwards, Secure Email Gateway supports Generation 2 deployment for Hyper-V models.

For more information, see the Cisco Content Security Virtual Appliance Installation Guide, available from https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

Generation 2 Deployment Support for Azure

From AsyncOS 15.0 release onwards, Secure Email Gateway supports Generation 2 deployment for Azure.

For more information, see the Cisco Secure Email Virtual Gateway and Secure Email and Web Manager Virtual on Azure Deployment Guide, available from https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

Microsoft Hyper-V Server 2019 Support

Secure Email Gateway 15.0 supports Microsoft Hyper-V Server 2019.

For more information, see the Cisco Content Security Virtual Appliance Installation Guide, available from https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

Supported Model for AWS Deployment

From AsyncOS 15.0 release onwards, the supported model for AWS deployment is C600V only.

For more information, see the Cisco Content Security Virtual Appliances on AWS EC2 Installation Guide, available from https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

New RAM Values for Secure Email Gateway Virtual Appliance Models

From AsyncOS 15.0 release onwards, there are new RAM values for the following Secure Email Gateway virtual appliance models deployed through KVM or VMWare ESXi:

• C100V

• C300V

• C600V

For details on the new RAM values applicable for each virtual appliance model, see the Cisco Content Security Virtual Appliance Installation Guide, available from https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

New DLP Policy Pre-defined Classifiers

The following new DLP policy pre-defined classifiers are added in the Mail Policies > DLP Policy Manager > Add DLP Policy > Custom Policy > Add > Policy Matching Details page of your web interface:

• Bank Account Numbers (Austria IBAN)

• Bank Account Numbers (Belgium IBAN)

• Bank Account Numbers (Bulgaria IBAN)

• Bank Account Numbers (Croatia IBAN)

• Bank Account Numbers (Cyprus IBAN)

• Bank Account Numbers (Czech Republic IBAN)

• Bank Account Numbers (Denmark IBAN)

• Bank Account Numbers (Estonia IBAN)

• Bank Account Numbers (Finland IBAN)

• Bank Account Numbers (Greece IBAN)

• Bank Account Numbers (Hungary IBAN)

• Bank Account Numbers (Ireland IBAN)

• Bank Account Numbers (Latvia IBAN)

• Bank Account Numbers (Lithuania IBAN)

• Bank Account Numbers (Luxembourg IBAN)

• Bank Account Numbers (Malta IBAN)

• Bank Account Numbers (Poland IBAN)

• Bank Account Numbers (Portugal IBAN)

• Bank Account Numbers (Romania IBAN)

• Bank Account Numbers (Slovakia IBAN)

• Bank Account Numbers (Slovenia IBAN)

• Bank Account Numbers (Spain IBAN)

• Cambodia National ID

• Cyprus National ID

• Finland National ID

• Malta National ID

• Myanmar National ID

• Portugal National ID

• Vietnam National ID

New Note for Removal of Weak Algorithms during System Upgrade

[Applicable to FIPS and non-FIPS modes]: During the system upgrade to AsyncOS 15.0 and later, a new Note statement is added to inform you that the system removes all weak algorithms in Ciphers, Keys, KEX, and MAC (if configured) after the upgrade process.

ECDSA Certificates Support for SSL Communication

You can now use the Elliptic Curve Digital Signature Algorithm (ECDSA) certificates that allow the combination of Elliptic Curve Diffie Hellman Ephemeral (ECDHE) algorithm for Key Exchange and ECDSA authentication to configure the following SSL services:

• GUI HTTPS

• Inbound SMTP

Landing Page

Reports Drop-down

My Reports Page

Mail Flow Summary Page

The Mail Flow Summary page includes trend graphs and summary tables for incoming and outgoing messages.

The Incoming Mail includes graphs and summary tables for the incoming and outgoing messages.

Advanced Malware Protection Report Pages

The following sections are available on the Advanced Malware Protection report page of the Reports menu:

• Summary

• AMP File Reputation

• File Analysis

• File Retrospection

• Mailbox Auto Remediation

The email gateway has the following Advanced Malware Protection report pages under Montior menu:

• Advanced Malware Protection

• AMP File Analysis

• AMP Verdict Updates

• Mailbox Auto Remediation

Outbreak Filters Page

The Past Year Virus Outbreaks and Past Year Virus Outbreak Summary are not available in the Outbreak Filtering report page of the new web interface.

The Monitor > Outbreak Filters page displays the Past Year Virus Outbreaks and Past Year Virus Outbreak Summary.

Spam Quarantines (Administrative and End Users)

Click Quarantine > Spam Quarantine > Search in the new web interface.

The end users can access the spam quarantine using the URL:

https://example.com:<https-api-port>/euq-login

where example.com is the appliance hostname and <https-api-port> is the AsyncOS API HTTPS port opened on the firewall.

You can view spam quarantine from the Monitor > Spam Quarantine menu.

Policy, Virus and Outbreak Quarantines

Click Quarantine > Other Quarantine in the new web interface.

You can only view Policy, Virus and Outbreak Quarantines in the new web interface.

You can view, configure and modify the Policy, Virus and Outbreak Quarantines on the email gateway using the Monitor > Policy, Virus and Outbreak Quarantines.

Select All Action for Messages in Quarantine

You can select multiple (or all) messages and perform a message action such as delete, delay, release, move, etc.

You cannot select multiple messages to perform a message action.

Maximum Download Limit for Attachments

The maximum limit for downloading attachments of a quarantined message is restricted to 25 MB.

-

Rejected Connections

To search for rejected connections, click Tracking > Search > Rejected Connection tab on the .

-

Query Settings

The Query Settings field of the Message Tracking feature is not available on the .

You can set the query timeout in the Query Settings field of the Message Tracking feature.

Message Tracking Data Availability

Click the gear icon on the upper right side of the page the web interface to access Message Tracking Data Availability page.

You can view the missing-data intervals for your email gateway.

Show Additional Details of Messages

You can view additional details of a message such as Verdict Charts, Last State, Sender Groups, Sender IP, IP Reputation Score and Policy Match details.

-

Verdict Charts and Last State Verdicts

Verdict Chart displays information of the various possible verdicts triggered by each engine in your email gateway.

Last State of the message determines the final verdict triggered after all the possible verdicts of the engine.

Verdict Charts and Last State Verdicts of the messages are not available.

Message Attachments and Host Names in Message Details

Message attachments and host names are not displayed in the Message Details section of the message on the email gateway.

Message attachments and host names are displayed in the Message Details section of the message.

Sender Groups, Sender IP, IP Reputation Score and Policy Match in Message Details

Sender Groups, Sender IP, IP Reputation Score, and Policy Match details of the message is displayed in the Message Details section, on the email gateway.

Sender Groups, Sender IP, IP Reputation Score, and Policy Match of the message is not available in the Message Details section of the message.

Direction of the Message (Incoming or Outgoing)

Direction of the message (incoming or outgoing) is displayed in the message tracking results page, on the email gateway.

Direction of the message (incoming or outgoing) is not displayed in the message tracking results page.