Support
|
|
|
|
|
Working with Filters and Policies > Managing filters > Creating and configuring a filter > Websense ThreatScope
|
|
Monitor (default). Message is delivered to its recipient, and a copy is sent to the file sandbox for analysis. If analysis determines that the attachment is clean, no report is returned. If analysis determines the attachment is malicious, the message is copied to a specified queue. A notification email regarding the analysis result can be sent.
|
The corresponding filter action should be configured to ensure that the email message that triggered the filter is dropped and saved to a specified queue (Main > Policy Management > Actions). Default queue is the virus queue.
|
|
Enforce. Message is held in a queue until the file sandbox analysis is performed. If analysis determines that the attachment is clean, message processing is resumed. If analysis determines the attachment is malicious, the email is quarantined. A notification email regarding the analysis result can be sent.
|
The corresponding filter action should be configured to ensure that the email message that triggered the filter is dropped and saved to a specified queue (Main > Policy Management > Actions). Default queue is the virus queue.
|
|
Enforce and notify. Message is held in a queue until the file sandbox analysis is performed, and an email notifying the recipient that analysis is underway can be sent. Mark the Send enforcement notification check box to configure this message, which contains the original message as an attachment. The message attachment is handled as follows:
|
The corresponding filter action should be configured to ensure that the email message that triggered the filter is dropped and saved to a specified queue (Main > Policy Management > Actions). Default queue is the virus queue.
|
|
Sender. Identify the notification message sender, from among the following options:
|
|
Administrator (default). If you use this option, you must configure a valid administrator email address in the Settings > General > System Settings page (see Setting system notification email addresses).
|
|
|
Recipient. Identify the notification message recipient, from among the following options:
|
|
|
Administrator. If you use this option, you must configure a valid administrator email address in the Settings > General > System Settings page (see Setting system notification email addresses).
|
|
|
Subject. Enter the subject that you want to be displayed when the notification is received.
|
|
|
Content. Enter the text that you want to be displayed in the notification message body.
|
|
|
Attachment. Specify whether you want to include the original message as an attachment to the notification message. Select from among the following:
|
See Creating and configuring a filter action for information about configuring an action for the ThreatScope filter.
You can configure bypass options for messages that you want to skip file sandbox analysis. Click Add in the bypass conditions section and specify the following information:
|
|
Condition name. Specify a name for each set of bypass conditions.
|
|
|
Sender email address/domain. Enter an individual email address or domain. Use an asterisk (*) for wildcard entries, and separate multiple entries with a semicolon (;).
|
|
|
Attachment filename keyword. Enter a character string that is included in the attachment filename.
|
Edit an existing bypass condition set by clicking the condition name in the bypass conditions table.
If you want message size to determine whether file sandbox analysis is bypassed, mark the Bypass ThreatScope analysis if message size exceeds check box and enter the target file size (default is 32 MB).
Please see ThreatScope product documentation and Websense Privacy Policy (www.Websense.com) for further information.
Quick Links
Service Requests
How are we doing?
Provide us feedback on your experience with the Service Request portal.
provide feedback >|
|
|
|
|
|
Working with Filters and Policies > Managing filters > Creating and configuring a filter > Websense ThreatScope
|
