Using policies to manage message scanning
Use these tasks to demonstrate the appliance scanning features in action. It provides step-by-step
instructions to create and test some sample policies and tells you how to generate applicable
reports.
A policy is a collection of settings and rules that tells the appliance how to combat specific
threats to your network. When you create real scanning policies for your organization, it is
important that you spend time researching and planning your requirements. You can find
guidelines to help you in your policy planning in the
Online help.
Before you create policies
All quarantine actions are disabled by default. Before you enable them, configure the appliance
to use the McAfee Quarantine Manager to manage the quarantine location. To do this:
1
From the user interface, select Email | Quarantine Configuration.
2
Enter details of your McAfee Quarantine Manager.
Creating an anti-virus scanning policy
Create an anti-virus scanning policy to:
• Detect viruses in incoming messages.
• Quarantine the original email.
• Notify the recipient.
• Alert the sender.
Task
Use this task to demonstrate what happens when a mass mailer virus rule is triggered by the
EICAR test file, and actions that can be taken.
1
On the appliance, ensure that you are using McAfee Quarantine Manager (Email |
Quarantine Configuration).
2
Select Email | Email Configuration | Sending Email.
3
Enter an email address for the Postmaster address.
Without this configuration, the appliance does not include a From: address on the email
notification. Most email servers do not deliver email without a From: address.
4
Click Apply All Changes.
5
Select Email | Email Policies | Scanning Policies | Anti-Virus | Viruses:
.
6
Select Attempt to clean as the primary action if cleaning succeeds.
7
Select Deliver a notification email to the sender and Quarantine the original email
as the secondary actions.
8
Select Replace detected item with an alert (Modify) if cleaning fails.
9
Click OK.
10 Select Email | Email Policies | Scanning Policies | Anti-Virus | McAfee
Anti-Spyware:.
11 Select Custom Malware Options; select Mass mailers.
12 In Custom actions, set If detected to Deny connection (Block).
Exploring the Appliance
Using policies to manage message scanning
McAfee Email and Web Security Appliance 5.1 Installation Guide
38
