User Guide

12-10
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 12 Anti-Virus
How to Configure the Appliance to Scan for Viruses
Action to Apply
Choose which overall action to take on each message type for encrypted, unscannable, or virus positive
messages: drop the message, deliver the message as an attachment to a new message, deliver the message
as is, or send the message to the anti-virus quarantine area (Quarantines and Anti-Virus Scanning,
page 12-10).
Configuring the appliance to deliver the infected messages as an attachment to a new message allows the
recipient to choose how to deal with the original, infected attachment.
If you choose to deliver the message or deliver the message as an attachment to a new message, you can
additionally:
• Modify message subject
• Archive original message
• Send generic notification
The following actions are available in the “Advanced” section of the GUI:
• Add custom header to message
• Modify message recipient
• Send message to alternate destination host
• Send custom alert notification (to recipient only)
Note These actions are not mutually exclusive; you can combine some or all of them differently within
different incoming or outgoing policies for different processing needs for groups of users. See the
following sections and Notes on Anti-Virus Configurations, page 12-14 for more information on
defining various scanning policies using these options.
Note Repaired messages have only two advanced options: Add custom header and Send custom alert
notification. All other message types have access to all of the advanced options.
Quarantines and Anti-Virus Scanning
When flagged for quarantine, the message continues through the rest of the email pipeline. When the
message reaches the end of the pipeline, if the message has been flagged for one or more quarantines
then it enters those queues. Note that if the message does not reach the end of the pipeline, it is not placed
in a quarantine.
For example, a content filter can cause a message to be dropped or bounced, in which case the message
will not be quarantined.
Modify the Message Subject Header
You can alter the text of identified messages by prepending or appending certain text strings to help users
more easily identify and sort identified messages.
Note White space is not ignored in the “Modify message subject” field. Add spaces after (if prepending) or
before (if appending) the text you enter in this field to separate your added text from the original subject
of the message. For example, add the text
[WARNING: VIRUS REMOVED] with a few trailing spaces if you
are prepending.