Trend Micro InterScan M Series, Руководство администратора

Страница: 81 / 480

How InterScan Gateway Security Appliance Works
3
-
21
Email Notification
Users and administrators need feedback when InterScan Gateway Security Appliance
intervenes to stop viruses, spyware, phishing attempts, access to blocked URLs, and
so on. To that end, InterScan Gateway Security Appliance can send email notifica-
tions about any action that it takes on SMTP, POP3, HTTP, and FTP traffic. The
appliance can insert inline notification stamps into all scanned message before send-
ing them, and senders, recipients, and administrators can receive standard or custom-
ized messages when the appliance performs a particular action. The appliance can
also notify TrendLabs of potential threats—for example, a phishing URL—thereby
enabling Trend Micro to verify the accuracy of the potential threat, classify it within
the TrendLabs databases, and if need be, take systematic action against the threat.
Logs
Administrators need a way to monitor scanning and detection activity of the appliance
over time. Monitoring these activities provides a historical view and enables you to
analyze those settings that you may need to modify to optimize security. InterScan
Gateway Security Appliance assists the administrator in these tasks by tracking all
scanning and detection activity that it performs and writing this information to vari-
ous logs. A log query feature allows you to create reports that show detection activity
for the different protocols for the various types of scanning tasks that InterScan Gate-
way Security Appliance performs. A log maintenance feature allows you to perform
log maintenance either manually or according to a schedule. You can also view the
event log.
Quarantine
Sometimes the best strategy for dealing with malware that arrives through
email—messages that contain viruses, spyware, or bots—is to quarantine the message
and its enclosures for further examination. The InterScan Gateway Security Appli-
ance allows you to quarantine messages, files, or enclosed objects suspected of being
malicious in a quarantine folder. The appliance can also quarantine email that has
triggered the content filtering rules.
InterScan Gateway Security Appliance allows you to query the quarantine folder by
time, sender, recipient, and subject. You can also perform basic maintenance on the
quarantine folder such as manually deleting email messages or setting a schedule to
delete email messages; and you can export a query of a set of quarantined files.