IronPort - daily management guide - AsyncOS 7.6.1

OL-25138-01
Quarantines
CHAPTER
4
Quarantines are special queues or repositories used to hold and process messages. Cisco IronPort
AsyncOS allows you to place incoming or outgoing messages into one of the appliance’s quarantines:
‘system’ and ‘IronPort Spam.’
Messages in quarantines can be delivered or deleted. You can create, modify, and delete quarantines. You
can associate users with quarantines. You can view the contents of each of your quarantines, search a
quarantine for specific messages, and send copies of the messages.
This chapter contains the following sections:
Quarantines Overview, page 4-1
Quarantines Overview
Quarantine Types
Managing System Quarantines via the Graphical User Interface (GUI), page 4-3
Working with Messages in System Quarantines, page 4-8
Configuring the Cisco IronPort Spam Quarantines Feature, page 4-18
Working with Safelists and Blocklists, page 4-37
As messages are processed by the Cisco IronPort appliance, various actions are applied. Filters are
applied to messages, messages are scanned for spam or viruses, and the Outbreak Filters feature scans
messages for targeted attacks. Any of these actions can cause a message to be quarantined, depending
on your settings.
A Cisco IronPort Spam quarantine is a special kind of quarantine used to hold spam or suspected spam
messages for end users. End users are mail users, outside of AsyncOS. You can have a local Cisco
IronPort Spam quarantine, stored on the Cisco IronPort appliance. You can also send messages to an
external Cisco IronPort Spam quarantine, stored on a separate Cisco IronPort appliance. Cisco IronPort
Spam quarantines can be accessed by both AsyncOS administrators and end users (these are not
AsyncOS users).
A system quarantine (unchanged from previous versions) is used to hold messages based on various
actions performed by AsyncOS, such as filtering, anti-virus scanning, and Outbreak Filters.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
4-1