The Threat Defense Connector client connects the Secure Email Gateway with the Secure Email Threat Defense to scan messages for Advanced Phishing and Spoofing. The ability to perform cloud-based advanced threat scanning helps an organization to:

• Get an advanced phishing and spoofing solution, and

• Avail security solutions to ever-changing phishing problems much faster than ever before.

When you configure the Threat Defense Connector, the Secure Email Gateway sends a copy of the actual message as an attachment to the Threat Defense portal’s message intake address in journaled format.

Once a message is scanned by all the scanning engines in the Secure Email Gateway and the message is safe to be delivered, the message is duplicated. A copy of the message is queued to be sent as an attachment in RFC 822 format to the Secure Email Threat Defense for advanced scanning. The original message gets delivered to the original recipient.

Email Gateway sends emails that are meant for advanced threat scanning over the standard SMTP interface using a minimum of TLS 1.2 as required on the Secure Email Threat Defense for the SMTP conversation. Threat Defense scans the messages and appropriate remediation action is taken on the message originally delivered to the user mailbox.

Note	Advanced threat scanning using Threat Defense Connector is applicable only for incoming messages.

Perform these steps in order:

As an email administrator, you need to set up the Secure Email Threat Defense to receive messages from Secure Email Gateway. For more information, see the Set up Secure Email Threat Defense chapter on the Secure Email Threat Defense User Guide.

Your message intake address is shown on the Secure Email Threat Defense setup page. If you need to find it after your initial setup, you can locate it on the Settings (gear icon) > Administration > Business page in the Account Details section. For more information, see Secure Email Threat Defense FAQ.

If you use centralized management, you can enable the Threat Defense Connector at the cluster, group, and machine levels.

Note	When you disable the Threat Defense Connector at the machine level, the same is disabled on the group and cluster levels.

You need to log in to Cisco Secure Threat Defense portal for viewing advanced scanning reports of Threat Defense Connector. For more information, see Cisco Secure Email Threat Defense User Guide.

You can view the the delivery status of outgoing emails under Monitor > Delivery Status. The Delivery Status Page provides monitoring information about email operations relating to a specific recipient domain. When Threat Defense Connector is enabled, you can view the delivery status of emails to the message intake address under the the.tdc.queue destination domain.

The Threat Defense Connector information is posted to the Mail Logs with a prefix 'TDC'.