Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

SPAM effectiveness report for an internal user

Years ago on a previous product, we had a report we could run which would show the SPAM effectiveness for an individual user.  This was useful for associates who felt they were receiving too much SPAM, when in reality, we were stopping 99.4% of the SPAM destined for them and the 2 they received over the past month were not devastating.

I looked through the reports available from the ESAs but do not see anything similar.  We are running ESA 7.6.3-019 and SMA 7.9.0-107.

 

Thanks

1 REPLY

Hello Mark,in general spam

Hello Mark,

in general spam efficiency reports would not work for individual, mainly because the spam detection process is not only limited to the spam engine, the major work is actually done by the reputation engine. In other words, senderbase, which on average blocks more that 90% of all connection attempts, mostly from hosts with a score of -5 or worse. By default these connections are already dropped before sender and recipients are injected, so the system is not aware who the potential spam was targeted for.

You could work around this by enabling delayed HAT rejection, which would still wait until sender and recipients are injected, before disconnecting.  In this case, you can check

 

GUI: Monitor->Incoming Mail

 

specify a time range, and then enter the internal user in the search field below the main table. Or leave it empty and just hit "Search" for a list of all users, the list then can be sorted by clicking on the column names.  The result table will contain entries like "Total Attemted" and "Spam Detected", and of course the results can be exported as well.

 

Hope that is what you are looking after.

Regards,

Andreas

 

65
Views
0
Helpful
1
Replies