IronPort - daily management guide - AsyncOS 7.6.1

Email Security Monitor Pages
Internal User Details
2-22
Using the Internal Users report, you can answer these kinds of questions:
Who is sending the most external email?
Who receives the most clean email?
Who receives the most spam?
Who is triggering which content filters?
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
Chapter 2 Using Email Security Monitor
Whose email is getting caught by content filters?
Inbound Internal Users are the users for which you received email, based on the Rcpt To: address.
Outbound Internal Users are based on the Mail From: address and are useful when tracking the types of
email that senders on your internal network are sending.
Note that some outbound mail (like bounces) have a null sender. They are counted under outbound and
“unknown.”
Click on an internal user to view the Internal User detail page for that user.
The Internal User detail page shows detailed information about the specified user, including a breakdown
of incoming and outgoing messages showing the number of messages in each category (spam detected,
virus detected, stopped by content filter, and clean). Incoming and outgoing content filter and DLP
policy matches are also shown.
Figure 2-19 Internal User Details Page
Click on a content filter name to view detailed information for that filter in the corresponding content
filter information page (see The Content Filters Page, page 2-25). You can use this method to get a list
of users who also sent or received mail that matched that particular content filter.
OL-25138-01