McAfee MAP-3300-SWG - Web Security Appliance 3300, Product Manual

Page: 125 / 336

Table 100 Option definitions (continued)
Option Definition
If the sender passes the check Provides actions to take. For example:
Allow through (Monitor)
- lets the message move to the next stage.
Add to score
- combines the results of several methods of sender authentication.
Enable DKIM verification Select to enable DomainKeys Identified Mail (DKIM) verification of email
messages.
Sender Authentication Settings — Cumulative Score and Other Options
Use this page to specify various options, including scoring techniques for authenticating senders.
If no method is entirely effective against untrusted senders, or some methods work better than others
in your network, you can associate scores to each method to refine the overall detection. To ensure
scoring works correctly, select Add to score as the action for every method that is in use.
Table 101 Option definitions
Option Definition
Check the total added score
,
Score
threshold
,
If this threshold is reached
Uses scores from several methods of sender authentication to
determine the action to take against an email message when its
sender cannot be authenticated.
Delay period when tarpitting Specifies a delay when acknowledging the sending of an email. The
default value of 5 seconds is often effective in deterring a
denial-of-service attack.
Parse the email headers for sender
address if behind an MTA
and
Number of hops to the MTA
If the appliance is preceded by Mail Transfer Agents (MTAs), specify
the number of hops from the appliance to the MTA. The appliance
can then parse the email headers to find the original sender and
check against that IP address.
File Filtering Settings
Use this page to specify actions against different types of file. This is known as file filtering.
Email
|
Email Policies
|
Scanning Policies
|
Compliance
|
File Filtering
The default policy values are normally suitable, but you might need another policy to allow the
occasional transfer of large, deeply nested files, or to investigate possible attacks.
Table 102 Option definitions
Option Definition
Order
Display the order in which the filters are applied. To change the order, click
icons in the
Move
column.
Rule Name Displays the rule name.
If Triggered
Displays the action to take.
Create new filtering rule If clicked, opens a further window where you can specify the types of file you
want to detect.
Change the default alert text
If clicked, opens a further window where you can change the alert message
that is issued after a detection.
Overview of Email features
Email Policies
McAfee Email and Web Security Appliances 5.6.0 Product Guide 125