Regenerating SSH Keys for SCP Push Log Retrieval

Your Secure Email Gateway maintains separate host keys for the SCP Push log retrieval. It also allows you to regenerate SSH keys for the SCP Push log retrieval.

You can regenerate SSH keys using the LOGCONFIG > HOSTKEYCONFIG > REGENERATESCPKEYS subcommand in the CLI.

You can regenerate these new keys only through the CLI and not via the web interface. You must have Administrator, or Cloud Administrator privileges to regenerate these new keys.

You can verify these new keys using the LOGCONFIG > HOSTKEYCONFIG > USER subcommand in the CLI.

The management of SSH keys varies depending on the scenarios:

New Install Scenario

When you net install the AsyncOS 16.0 version, a new SSH key is generated.

Upgrade Scenario

When you upgrade from AsyncOS 15.5.1 or earlier version to AsyncOS 16.0, you are prompted for consent to inquire if you want to regenerate SSH keys. If you choose to generate new keys, then a new key is generated, if not, the old key is retained.

When you upgrade from AsyncOS 16.0 earlier version to AsyncOS 16.0 later version, you are not prompted for consent to inquire if you want to generate SSH keys. The available SSH key is retained.

Revert Scenario

When you revert from AsyncOS 16.0 to an earlier version, you will receive a warning message indicating if you need to replace SSH keys on the SCP push log server. If you have not generated new SSH keys, the warning message is not displayed, and you need not replace SSH keys on the SCP push log server.

When you revert from the AsyncOS 16.0 later version to the AsyncOS 16.0 earlier version, the available SSH keys are retained.

For more information, see Configuring Host Keys.

Enhanced File Hash List Support for Content Filters

Your Secure Email Gateway now supports listing file hash lists created with the MD5 Only file hash type option, in addition to those created with the SHA256 Only file hash type option for content filters.

You can select the file hast list created with the MD5 Only file hash type option for content filters through the following pages of the web interface:

• Navigate to Mail Policies -> Incoming Content Filter and click Add Filter. Under Conditions, click Add Conditionand choose Attachment File Info from the Add Condition window.

• Navigate toMail Policies -> Incoming Content Filter and click Add Filter. Under Actions, click Add Actionsand choose Strip Attachment by File Infofrom the Add Actions window.

When you select the File Hash List radio button, the file hash lists created with the MD5 Only file hash type option are also listed along with file hash lists created with the SHA256 Only file hash type option.

For more information, see

Enhanced Alert Emails

You receive alert emails from Secure Email Gateway when you encounter issues with the following limits:

• Disk Quota for Miscellaneous Services

• Envelope Sender Rate Limit

• File Analysis Upload Limit

These Alert emails are enhanced to include a direct link to a comprehensive Tech Zone article. This Tech Zone article provides detailed solutions to address your technical inquiries.

Upgrading Image Analysis Engine to IA8.0

Your Secure Email Gateway is now enhanced with the latest Image Analysis (IA) Engine 8.0. This upgrade from the previous IA6.0 version significantly improves the accuracy of scanning scores.

You will notice a score difference between the two versions, as IA8.0 employs advanced algorithms for more precise image analysis.

For more information about Image Analysis, see Image Analysis .

Support for Bounce Verification, SMTP Call Ahead, and Message Filters using AsyncOS APIs

You can now use AsyncOS APIs to view and configure Bounce Verification, SMTP Call-Ahead, and Message Filters in your email gateway.

For more information, see the “Configuration APIs” section of the AsyncOS 16.0 API for Cisco Secure Email Gateway Getting Started Guide - BETA.

Integrating with Email Threat Defense for Microsoft Office Server (on-premises)

If you are using Microsoft Exchange Server (on-premises), you can now use Email Threat Defense API and Email Threat Defense API Polling to perform Mailbox Auto Remediation of convicted emails identified by Secure Email Threat Defense. This feature can be configured via GUI and

threatdefenseconfig command in the CLI.

For more information, see Integrating Secure Email Gateway with Threat Defense.

Email Threat Defense Remediation Report

A new report - Email Threat Defense Remediation has been added to the Remediation Reports page.

For more information on the Email Threat Defense Remediation report, see Remediation Report Page.

Setting Priority for Message Headers

You can now choose to consider only selected priority header for Mail Policy Settings. This can be used if you want the mail policy to match only the priority selected in Match Priority.

Secure Email Relay in Smart Licensing for Virtual Gateways

Secure Email Relay feature lets you send large volumes of emails using the Secure Email Gateway. This feature is only available for accounts with Smart Licensing in virtual gateways, not for on-premises or cloud setups. For more information, see Secure Email Relay in Smart Licensing for Virtual Gateways.

Support for Mail Transfer Agent Strict Transport Security (MTA-STS)

Mail Transfer Agent Strict Transport Security (MTA-STS) protocol enables Secure Email Gateway to determine and act on the TLS policy of a peer Mail Transfer Agent (MTA) for outbound emails, ensuring secure email transmission. You can enable MTA-STS support while configuring the Destination Controls in Secure Email Gateway. For more information, see Mail Transfer Agent Strict Transport Security.

Transitioning from SecureX to XDR

Cisco SecureX is transitioning to an enhanced and more robust platform, Cisco XDR (Extended Detection and Response). As part of this transition, it is essential to integrate your Secure Email Gateway with the new XDR platform.

For more information on how to integrate Secure Email Gateway with XDR, see Integrating with Cisco XDR.

Displaying Warning Messages for Non-Compliant X.509 Certificates

Your Secure Email Gateway now displays warning messages when you import a non-compliant X.509 certificate using the Network → Certificates → Add Certificate page on the web interface or certconfig -> IMPORT or PASTE command in the CLI. Despite the warnings, the certificate will still be uploaded.

The warning messages are displayed for the following scenarios:

• Unregistered URI Schemes in SAN Field - When you import an X.509 certificate that uses a URI with schemes that are not registered with IANA in the Subject Alternative Name (SAN) field, the following warning message is displayed:

  Warning: The X.509 certificate must not use URIs with schemes that are not registered with IANA (such as ‘invalid’). However, the certificate will still be uploaded.

• SAN - CN Entry Mismatch - When you import an X.509 certificate, it must contain at least one SAN entry exactly matching the CN entry, otherwise the following error message is displayed:

  Warning: The X.509 certificate must contain at least one SAN entry exactly matching the CN entry: tlstest-SAN-has-no-CN.com. However, the certificate will be uploaded.

• Incorrect IP Address Format in SAN field - When you import an X.509 certificate with an IP address in the wrong format in the SAN field, the following warning message is displayed:

  Warning: The X.509 certificate must not use IP addresses in the format ‘10.10.2.32’ in the Subject Alternative Name (SAN) field. It must be in the format: ’ipAddress-type’. However, the certificate will still be uploaded.

• Incorrect IP Address Format in CN field and SAN - CN Entry Mismatch - When you import an X.509 certificate with an IP address in the wrong format in the CN field and if the X.509 certificate does not contain at least one SAN entry exactly matching the CN entry, the following warning message is displayed:

  Warning: The X.509 certificate must not use IP addresses in the format ‘10.10.2.32’ in the CommonName (CN) field for the Subject.

  The X.509 certificate must contain at least one SAN entry exactly matching the CN entry. However, the certificate will still be uploaded.

You can view consolidated warning messages on the Certificates (Network → Certificates) page.

Nutanix Support

Your Secure Email Gateway 16.0 now supports Nutanix.

Nutanix Version Details:

• Nutanix AOS: 6.5.5.7

• Nutanix Prism Central: pc.2022.6.0.10

For more information, see Cisco Secure Email Virtual Gateway and Secure Email and Web Manager Virtual Appliance Installation Guide available at https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

[On-premises only] ESXi 8.0 Support

Your Secure Email Gateway 16.0 now supports ESXi 8.0.

For more information, see Cisco Secure Email Virtual Gateway and Secure Email and Web Manager Virtual Appliance Installation Guide available at https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-installation-guides-list.html.

Landing Page

Reports Drop-down

My Reports Page

Mail Flow Summary Page

The Mail Flow Summary page includes trend graphs and summary tables for incoming and outgoing messages.

The Incoming Mail includes graphs and summary tables for the incoming and outgoing messages.

Advanced Malware Protection Report Pages

The following sections are available on the Advanced Malware Protection report page of the Reports menu:

• Summary

• AMP File Reputation

• File Analysis

• File Retrospection

• Mailbox Auto Remediation

The email gateway has the following Advanced Malware Protection report pages under Montior menu:

• Advanced Malware Protection

• AMP File Analysis

• AMP Verdict Updates

• Mailbox Auto Remediation

Outbreak Filters Page

The Past Year Virus Outbreaks and Past Year Virus Outbreak Summary are not available in the Outbreak Filtering report page of the new web interface.

The Monitor > Outbreak Filters page displays the Past Year Virus Outbreaks and Past Year Virus Outbreak Summary.

Spam Quarantines (Administrative and End Users)

Click Quarantine > Spam Quarantine > Search in the new web interface.

The end users can access the spam quarantine using the URL:

https://example.com:<https-api-port>/euq-login

where example.com is the appliance hostname and <https-api-port> is the AsyncOS API HTTPS port opened on the firewall.

You can view spam quarantine from the Monitor > Spam Quarantine menu.

Policy, Virus and Outbreak Quarantines

Click Quarantine > Other Quarantine in the new web interface.

You can only view Policy, Virus and Outbreak Quarantines in the new web interface.

You can view, configure and modify the Policy, Virus and Outbreak Quarantines on the email gateway using the Monitor > Policy, Virus and Outbreak Quarantines.

Select All Action for Messages in Quarantine

You can select multiple (or all) messages and perform a message action such as delete, delay, release, move, etc.

You cannot select multiple messages to perform a message action.

Maximum Download Limit for Attachments

The maximum limit for downloading attachments of a quarantined message is restricted to 25 MB.

-

Rejected Connections

To search for rejected connections, click Tracking > Search > Rejected Connection tab on the .

-

Query Settings

The Query Settings field of the Message Tracking feature is not available on the .

You can set the query timeout in the Query Settings field of the Message Tracking feature.

Message Tracking Data Availability

Click the gear icon on the upper right side of the page the web interface to access Message Tracking Data Availability page.

You can view the missing-data intervals for your email gateway.

Show Additional Details of Messages

You can view additional details of a message such as Verdict Charts, Last State, Sender Groups, Sender IP, IP Reputation Score and Policy Match details.

-

Verdict Charts and Last State Verdicts

Verdict Chart displays information of the various possible verdicts triggered by each engine in your email gateway.

Last State of the message determines the final verdict triggered after all the possible verdicts of the engine.

Verdict Charts and Last State Verdicts of the messages are not available.

Message Attachments and Host Names in Message Details

Message attachments and host names are not displayed in the Message Details section of the message on the email gateway.

Message attachments and host names are displayed in the Message Details section of the message.

Sender Groups, Sender IP, IP Reputation Score and Policy Match in Message Details

Sender Groups, Sender IP, IP Reputation Score, and Policy Match details of the message is displayed in the Message Details section, on the email gateway.

Sender Groups, Sender IP, IP Reputation Score, and Policy Match of the message is not available in the Message Details section of the message.

Direction of the Message (Incoming or Outgoing)

Direction of the message (incoming or outgoing) is displayed in the message tracking results page, on the email gateway.

Direction of the message (incoming or outgoing) is not displayed in the message tracking results page.