This manual is for administrative users of NetIntelligence MailFilter. The following two sections of this guide describe:

Transcription

1

2 Contents Contents Introduction About This Manual Technical Requirements Getting Started Logging in to the MailFilter Control Centre Layout of the Control Centre screens Quarantine Manager Adding Addresses to Black- and White-lists MailFilter Reports Usage Analyser Advanced Configuration Overview MailFilter's default policy the 'Default anti-spam policy' Configuring Accounts and Domains Specifying Domains Specifying Accounts Creating and Applying MailFilter Policies Creating Scenarios Creating Responses Creating Policies Applying Policies Questions and Answers Contact Details Appendix A: Example Reports

3 1 Introduction Welcome to the NetIntelligence MailFilter, which enables you to manage your system by filtering to and from your organisation, via our MailFilter servers. MailFilter detects, identifies and stops spam, phishing, and other inappropriate content using flexible 'policies', and provides comprehensive anti-virus protection. MailFilter can be used 'out of the box', with predefined (or default) filtering functionality which is suitable for most users. This predefined functionality is explained in the first section of this Guide, Getting Started on p4. However, if you want more flexibility, you can easily set up your own filtering rules using the online Control Centre. These topics are covered in the Advanced Configuration section on p15. With NetIntelligence MailFilter, you will benefit from extensive protection, restoring back to its rightful position as the #1 communications tool. 1.1 About This Manual This manual is for administrative users of NetIntelligence MailFilter. The following two sections of this guide describe: Getting started, using the basic configuration of MailFilter Advanced configuration of MailFilter (creating custom policies) 1.2 Technical Requirements NetIntelligence MailFilter does not require any new hardware or software to be installed on your network. All filtering is carried out on our MailFilter servers. As all monitoring is conducted away from your network, you will immediately benefit from a reduction in bandwidth usage. Once you have subscribed to NetIntelligence MailFilter, you will be provided with details of changes that should be made to your MX record 1, to re-route your mail to our MailFilter servers. This change will be made by your network administrator, or by your ISP 2. Amendment of MX records is normally carried out by your ISP but many domain registration companies have domain control panels which can be used. Contact your current domain host for further information on making these kinds of changes. 1 Mail exchange Record. An MX record is an entry in the domain name system (DNS) which identifies the mail server responsible for handling s for a domain name. When more than one MX record is entered for any single domain name, the MX record can be prioritized with a preference number that indicates the order in which the mail servers should be used. This enables the use of primary and backup mail servers. 2 If your domain is registered through iomart group plc, then this change will be made on your behalf - you do not need to contact NetIntelligence MailFilter Support. It may take up to 24 hours for MX record changes to take effect. The change will not be visible in the MailFilter Control Centre until this time. 3

4 2 Getting Started All of MailFilter's screening and processing activities are carried out on the MailFilter servers, away from your information infrastructure. You control the way that MailFilter handles your incoming/outgoing by configuring settings using the MailFilter web-based Control Centre. The types of processing that are carried out by MailFilter are described throughout this Guide, as each configuration option is introduced. 2.1 Logging in to the MailFilter Control Centre To log in to the MailFilter Control Centre, in your web browser, navigate to the 'login' web address (supplied to you when you subscribed to MailFilter). Enter your account address (which serves as your MailFilter Control Centre username) and password (Figure 1). These are the details which NetIntelligence MailFilter Support supplied to you when you subscribed. Figure 1: MailFilter Log-in page 4

5 When your login has been verified, the MailFilter Control Centre 'Home' page will be displayed (Figure 2): Figure 2: The 'Home' page All of the functionality of the Control Centre can be accessed from this screen. 5

6 The two main areas of functionality provided by the MailFilter Control Centre are: Configuration of the filtering behaviour of NetIntelligence MailFilter for your system. Reporting of information on traffic in your system. Aspects of MailFilter which you can configure are: domain groups groups of addresses accounts individual addresses 3 Filtering policies sets of rules to be applied to either from or to an address or group of addresses. The concept of a policy includes: o scenarios If such-and-such happens. o responses then do such-and-such. o rules scenario-response pairings Black-list a customised scenario, which contains specific addresses to be recognised, where the response would usually prevent normal delivery to the recipient White-list another customised scenario, which contains specific addresses to be recognised, where the response would usually allow normal delivery to the recipient Phrase list(s) another customised scenario, containing keywords to be recognised Quarantine and archive areas places on the MailFilter servers where intercepted can be stored for later review. Some of these configurable options are more advanced, and are described in the later section Advanced Configuration (p15). The basic configuration options we will be discussing in this section are 'Quarantine', 'Adding Addresses to Black- and White-lists', 'Reports' and the Usage Analyser. 3 For the purposes of the MailFilter (and this Guide), account and account mean simply the address, e.g. someone@somewhere.com. 6

7 2.2 Layout of the Control Centre screens Each screen in the MailFilter Control Centre is laid out in a similar way. As an example, the 'Accounts' screen is shown below (Figure 3): Figure 3: General screen layout Each screen has a menu of links, which you can use to navigate through the screens. The main areas of the application are listed here. Each screen also has a title, which shows the name of the screen itself, plus the 'route' you have navigated to get to the current screen, made up of the titles of previous screens. You can click on these to navigate back to any screen in the route. The remainder is the screen's body, which provides the functionality specific to each screen. 7

8 The links shown in the menu section are as follows: Return to the NetIntelligence Business Plus dashboard screen Display the 'Home' page Display the ' Filtering Setup' screen Create or edit records of accounts, and apply policies to them Create or edit policies Create or edit scenarios Create or edit responses Review (and configure settings for) quarantined and archived Create or edit phrase lists Run and view (or delete) standard MailFilter reports Analyse traffic in real time End your session on the MailFilter Control Centre. Figure 4: The MailFilter menu The main body of the 'Home' page provides some additional links as 'shortcuts' to certain areas of the application. 8

9 2.3 Quarantine Manager The Quarantine Manager allows you to review all s that have been quarantined by NetIntelligence MailFilter (Figure 5). Figure 5: The Home page link to the 'Quarantine Manager' screen To display the 'Quarantine Manager' screen (Figure 6), you can either use the links provided in the main area of the 'Home' page, which allow you to view quarantined items for 'Today', 'This Week' and 'All' (shown above), or click the 'Quarantine' link in the menu (which defaults to the 'Today' view). Figure 6: The 'Quarantine Manager' screen In this screen, you can look at messages which have been quarantined by MailFilter, and then decide on how they should be dealt with. You can also use this screen to search your MailFilter archive folders. By default, the Quarantine Manager screen displays all of the s which have been quarantined today (or 'this week' or 'all', depending on which button you used to navigate to this page). You can refine the results by selecting messages by intended recipient or by sender. To do this, enter the address into the 'Sender' or 'Recipient' boxes. Alternatively, all the messages in a particular queue can be selected for assessment. You can use the dropdown list labelled 'Queue', to specify the messages in a particular queue that you want to view (for more information on using queues for archiving , see Creating Responses on p33 of this Guide). The 'Per page' drop-down list lets you define the number of messages that are displayed per page. 9

10 The 'Date Filter' radio buttons allow you to specify time ranges to show results for. When you have specified your parameters, click 'Search'. The results of your search will then be displayed. You can select a message from among the results by clicking the checkbox next to the entry. When you want to delete multiple messages, you can check the checkboxes and then use the 'Delete selected' button to delete the messages all at once. Alternatively, you can delete individual messages as you inspect them, using the 'wastepaper bin' delete icon. The same procedure is used for when you want to deliver individual or multiple messages just use the 'Deliver selected' and 'mail' icon instead. You can view a message by clicking on the hyperlinked entry in the 'Subject' column of the table of results. 2.4 Adding Addresses to Black- and White-lists Your 'Black-list' is a predefined list in MailFilter, which blocks from the addresses you specify. To add an address to your Black-list, click on the 'View' button on the 'Home' page for 'Manage your Black-list': Figure 7: The Home page link to the 'Edit: Black-list' screen The 'Edit: Black-list' screen will be shown, as displayed below (Figure 8): Figure 8: The 'Edit: Black-list' screen 10

11 To add an address to your Black-list, enter the address into the box labelled 'Add new address or domain', and click the 'add' button. You'll see that the address you just entered is added to the list (Figure 9): Figure 9: Addresses added to the Black-List As stated on screen, you specify a whole domain (i.e. all addresses ending in the domain name), by entering the '@' sign plus the domain name. If you want to delete an entry from the list, click the 'wastepaper bin' icon in the 'Delete' column of the table against the address you want to delete. Exactly the same procedure applies for the White-list just click the 'View' button alongside 'Manage your White-list'. 11

12 2.5 MailFilter Reports The 'Report Manager' screen allows you to create and view PDF reports based on MailFilter activity (Figure 10). To open this screen, click the 'Reports' link in the menu. Figure 10: The 'Report Manager' screen MailFilter's predefined reports are listed in the 'Report Templates' table. To generate a report, click the blue 'target' button alongside the report template you want to use. When you do this, a 'Report Details' screen is displayed, with the details of the report you are about to run (Figure 11): Figure 11: The 'Report Details' screen You can edit these details as required. To begin running the report, click 'save'. A record is then displayed in the 'Today's reports' table, with a status of 'new'. This tells you that the generation of your report is in progress. Click the 'refresh' button. When the status of the report changes to 12

13 'complete', your report is ready for viewing. To view your new report, click the green 'target' button in the 'View' column against the report you want to view. If you see a file download dialog box, select either 'Save' or 'Open' as required. To remove a report, click the red 'target' button in the 'delete' column, against the report you want to delete. Please refer to Appendix A on p44 of this Guide for some example reports. 13

14 2.6 Usage Analyser The usage analysis facility allows you to analyse traffic in real-time, to identify possible abuses of acceptable use policies. This facility is available from the 'Real Time Analysis' menu option. The analyser provides a summary of activity on your domain, from which you can 'drill-down' through domains and addresses right down to individual conversation level. 1. Analysis results show summary of activity 2. Drill down to see more detail about a chosen domain or address, highlighting areas for investigation 3. Drill deeper to see summaries of conversations between individual addresses, enabling you to check whether your usage policies are being abused. 14

15 3 Advanced Configuration 3.1 Overview MailFilter uses policies to apply rules to being filtered. These policies are made up of rules, which in turn are made up of a pairing of a scenario to a response (for more information on policies, see Creating and Applying MailFilter Policies on p21 of this Guide). MailFilter provides a default policy, the 'Default anti-spam policy' (discussed below), which is a predefined policy, applied to your domain group(s) when you begin using MailFilter. If you decide that this policy will meet your needs, then there is no further configuration required on your part. However, you also have the option to configure MailFilter to meet your requirements exactly. The remainder of this configuration section shows you how to do this. In general terms, the purpose of configuring MailFilter is to model your organisation's Acceptable Use Policy for your system, so that MailFilter can enforce certain aspects of acceptable use. Your Acceptable Use Policy (AUP) is your set of (usually written) instructions to employees, on what can and can't be done using the organisation's system. These instructions may prohibit the use of the organisation's system for personal non-work-related use, or for transmitting inappropriate content, for example. The screening in NetIntelligence MailFilter works by applying filtering policies to addresses belonging to your system (either individual addresses or groups of addresses), so that your organisation will only ever receive or send the types of you want it to receive or send. 4 For example, if your AUP states that: Employees shall not open attachments from sources other than the organisation you can model this, and enforce compliance, by creating and applying a MailFilter policy which contains this rule: then If has an attachment from a source other than the organisation, strip the attachment and deliver as normal. If you wanted to review these stripped attachments, you could for example add another rule to your policy: 'If has an attachment from a source other than the organisation, archive the with attachment'. 4 Note that MailFilter s anti-virus protection will be applied to all , irrespective of policy settings. 15

16 3.1.1 MailFilter's default policy the 'Default anti-spam policy' The 'Default anti-spam policy' is a predefined policy which is applied to your domain group(s) when you begin using MailFilter (Figure 12). Figure 12: Default anti-spam policy You can see that the default anti-spam policy is made up of four rules. MailFilter will apply these rules to any s sent to those accounts which are being filtered using the default anti-spam policy 5. Rule 1: For any sent to this account, log that . Rule 2: If an is sent to this account from an account on my organisation's black-list, then bounce 6 that and save a copy for me to review. Rule 3: If an is sent to this account from an account on my organisation's white-list, then deliver that as normal without doing anything else. Rule 4: If an sent to this account is identified as spam, then quarantine that . The same policy can be applied to any number of domains or accounts. Each domain or account can have either an incoming policy or an outgoing policy, or both, applied to it. As the names suggest, an incoming policy is applied to all s sent to a specified address, while an outgoing policy is applied to all s sent from a specified address. These policies, taken together, reflect the Acceptable Use Policy of your organisation, with regard to individuals or groups of individuals using your system. To summarise, MailFilter configuration consists of two key aspects defining policies, and applying policies to addresses and domains. 5 The default anti-spam policy therefore has an incoming policy type it applies to incoming only. See Creating Policies on p37 of this Guide for more information on policy types, and how and when to assign them. 6 Bouncing an is simply blocking delivery and sending an automatic response to the sender that the couldn t be delivered. 16

17 3.2 Configuring Accounts and Domains REMEMBER you do not need to specify each address in your domain a policy can be applied to the domain itself. To begin adding accounts into MailFilter, click the 'Accounts' link in the menu on the left hand side of the 'Home' page. The ' Addresses and Domains' screen will then be shown, as below (Figure 13): Figure 13: The ' Addresses and Domains' ('Accounts') screen The table contains details of groups and addresses that you've already entered into MailFilter. When you first use the Control Centre, you'll see that there is already a group and an address listed; these have been created for you, from the information you originally supplied when subscribing to the product (i.e. your address and domain). For the purposes of MailFilter, each row in the table represents something which can have a policy applied to it. So, under the 'Name' column, we have your organisation's name (the top row), the names of any groups that have been set up (under the 'Groups' row subheading), and the names of individual accounts (under the 'Accounts' row subheading). The 'Policy In' column of the table shows the policy that you have specified to be applied to incoming mail for this entry in the table. Similarly, the 'Policy Out' column shows the policy that you have specified to be applied to outgoing mail for this entry. The 'Delete' column shows a red 'target' button wherever it is possible to delete an entry from the table. The 'Edit/View' column shows a green 'target' button against each entry, which 'drills down' to the 'Edit' screen for that entry. 17

18 3.2.1 Specifying Domains The domains which will be filtered by MailFilter are shown in the 'Global Settings' screen for your organisation. To access this screen, click the 'Edit/View' link in the Accounts screen against your organisation's name (Figure 14). Figure 14: The Organisation's global settings entry in the 'Accounts' screen The Global Settings screen will then be shown (Figure 15): Figure 15: Your Organisation's 'Global Settings' screen You can apply policies at this global level if desired. These policies will then apply to all domains filtered by MailFilter. However, to apply different rules to different domains, you should instead create an ' domain group' for each domain. 7 To do this, click on the 'new group' button in the ' addresses and domains' table, under the 'Groups' heading. The 'New group' screen will be shown (Figure 16): Figure 16: The 'New group' screen In the 'Name' box, enter the domain name. If you already have policies set up, and know which incoming and/or outgoing policy you want to apply to the domain group, you can specify the incoming and outgoing policies here. You can find more information on setting up policies in section 3.3 Creating and Applying MailFilter Policies on page Note that any domains you registered when beginning your subscription to MailFilter will already be set up by NetIntelligence Support. 18

19 When you have specified the necessary information, click the 'save' button to store the new record. When you go back into the ' addresses and domains' screen, you will see your new record listed in the table under 'Accounts'. (To discard your changes, simply navigate away from the page.) Tip for expert users it is possible to specify domains which you don't own, for example to apply a policy to hotmail.com Specifying Accounts If you want to apply a policy to an individual account, you need to create a separate entry for the account. Note that you don t have to carry out this step (of creating individual account records) in order to use MailFilter the policy you apply to the domain group (or, if you do not apply a policy, then MailFilter s default policy) will be applied automatically to all accounts in the domain. To create a new entry in this table for a specific account, click on the 'new account' button. The 'New account' screen will be shown (Figure 17). This screen has a dual purpose: it allows you to specify individual accounts; and it allows you to create additional logins to the MailFilter Control Centre. Figure 17: The 'New account' screen For each new record, you must specify: The address The password if required. Note that you only enter a password here if you want this address and password to be used as a login for the MailFilter Control Centre, as well as being used to refer to an address that is filtered by MailFilter 8. The account user's forename The account user's surname 8 Note that the password referred to here is not any password associated with the account on your system the password entered here is used (and applies) only in the MailFilter Control Centre. 19

20 If you already have policies set up, and know which incoming and/or outgoing policy you want to apply to the individual account, you can specify the incoming and outgoing policies here. The 'Account privileges' section applies only if you want this address and password to be used as a login for the MailFilter Control Centre. Here you can specify which MailFilter user privileges are to be applied to the login you are creating. The privileges associated with each account are described below: Company Administrator Policy Administrator Quarantine Administrator Management Reporting This type of account has access to all MailFilter functions. This type of account has access to all MailFilter functions relating to policies, i.e. adding/deleting/editing policies. This type of account has access to all MailFilter functions relating to quarantine, i.e. access to the Quarantine Manager, and quarantine functions in responses. This type of account has access to all MailFilter functions relating to reporting, i.e. adding/deleting/running reports. When you have specified the necessary information, click the 'save' button to store the new record. When you go back in to the ' addresses and domains' screen, you will see your new record listed in the table under 'Accounts'. (To abandon your changes, click the '<< prev' button instead of the 'save' button.) Once you have created the new account record, if you wish you can add the account to a group or groups that you have previously set up. This is done via the 'Edit Account' screen (Figure 18): Figure 18: Adding an account to a group This means that the policies (or MailFilter rules) applied to the group will apply to this account. Alternatively you can apply policies directly at the individual account level. Note however that if you have created an domain group for this address's domain, then the domain group's policies will automatically apply to this address. The application of policies is described in the following section. 20

21 3.3 Creating and Applying MailFilter Policies As already explained in section 3.1 Overview (p15), a policy is a set of one or more rules, which are in turn made up of scenario-response pairings Creating Scenarios Scenarios define the tests which will be performed on an . To create a new scenario, click on the '- scenarios' link in the menu. The 'Scenarios' screen will be shown (Figure 19): Figure 19: The 'Scenarios' screen As you can see, existing scenarios are listed in the table. MailFilter provides a preset policy to get you started the Default anti-spam policy. This policy is made up of rules which use the scenarios and responses you will see when you first use the Scenarios and Responses screens. The scenarios shown here, All s, Black-list, White-list and Identify spam are all predefined by MailFilter. Every scenario has a MailFilter scenario 'type'. These types help you to specify what you want MailFilter to recognise in an in transmission. Different configuration options are available for scenarios of different types (Figure 20). Figure 20: The 'Add new scenario' drop-down list Creation of each of the available scenario types is described in detail below. 21

22 Address analysis This type of scenario triggers a response on the basis of the sender's or recipient's address. Predefined Scenarios: Black and White Lists MailFilter's Black- and White-lists are simply address analysis scenarios which have been predefined for you, and are used in MailFilter's default policy. The responses paired with these scenarios in the default policy are 'Bounce and Archive' for the Black-list, and 'Deliver' for the White-list. You can 'attach' any response you like to these scenarios the responses are not predefined, although the thinking behind using these lists is to prevent normal delivery of the black-listed addresses, and to allow normal delivery of the white-listed addresses, so you would normally choose a response in line with this. To create a new address analysis scenario, select 'Address analysis' from the 'Add new scenario' drop-down list (shown above), and click the 'new' button. The 'New Scenario' screen will be displayed, where you name your new scenario (Figure 21): Figure 21: The 'New scenario' screen for 'Address Analysis' Enter the name you have chosen into the box provided. In this example, we're defining a scenario, which we're calling 'Personal mail', in which MailFilter will look at a list of addresses of free domains, the likelihood being that from these addresses will be personal rather than work-related. Note: a good rule of thumb for naming your scenarios, is to fit the scenario into an If then sentence. For example, if you wanted to create a scenario which would recognise s with attachments, you could say If attachment present, then. The name for your scenario would be Attachment present. The same thing applies for responses: If attachment present, then strip attachment. The name of your response would be Strip attachment. After you have named your scenario, click the 'save' button. 22

23 This will take you to the 'Edit Scenario' screen for address analysis scenarios (there are different configuration options for each scenario type). Here you can configure your new scenario (Figure 22): Figure 22: The 'Edit scenario' screen for a new 'Address analysis' scenario As you can see, the name of your new scenario is displayed, along with its description. You can edit the name or description by clicking on the 'edit' button on the right hand side. Under 'Details', you'll add the individual addresses, or whole domains, which you want MailFilter to identify and process in some way (this processing will be defined in the response you attach to the scenario). In the example, we've added the Hotmail and Yahoo free domains (Figure 23): Figure 23: The 'Edit scenario' screen for an 'Address analysis' scenario, with addresses added As stated on screen, you specify a whole domain (i.e. all addresses ending in the domain name), by entering the '@' sign plus the domain name. Each time you enter an address or domain, click the 'add' button, and you entry will appear in the list under ' addresses and domains currently in your [scenario name] '. If you want to delete an entry from the list, click the 'wastepaper bin' icon in the 'Delete' column of the table against the entry you wish to delete. (Note that you cannot delete a scenario or response while they are being used in a rule in a policy. You must remove them from the policy first.) 23

24 File type analysis A file type analysis scenario triggers a response on the basis of the type of file that is attached to or contained in a message. In this example, we're defining a scenario, which we're calling 'Audio file found', in which MailFilter will check the content and attachments of s for audio files above a certain size. After naming your new scenario, click the 'save' button. This will take you to the 'Edit Scenario' screen for file type analysis scenarios (Figure 24): Figure 24: The 'Edit scenario' screen for a 'File type analysis' scenario The 'Content Type' drop-down list contains all the various file types that MailFilter can detect. MailFilter uses sophisticated techniques to determine the content or type of files in each of the categories available. When you've entered the content type and size limit, click the 'add' button to store your new record. Figure 25: The 'Add new Content Type' drop-down list 24

25 Specific file identifier A specific file identifier scenario triggers a response on the basis of an attachment having a specific file name. In this example, we're defining a scenario, which we're calling 'BadProgram.exe file found', in which MailFilter will check the content and attachments of s for the specific file 'BadProgram.exe' (Figure 26). Figure 26: The 'Edit scenario' screen for a 'Specific file identifier' scenario Similarly to the file type scenario, this scenario type allows you to specify multiple filenames to be filtered. In addition, you can specify filtering of all files with a particular file extension, e.g. '.exe'. Note that for this, you simply type in the 'period' (. ) and the extension there is no need to use a wildcard such as an asterisk (i.e. '*.exe'). The 'specific file' scenario edit screen works in the same way as the other scenario edit screens already mentioned. 25

26 Legal disclaimer This type of scenario allows you to add a legal disclaimer (or footer) to messages (Figure 27). Figure 27: The 'Edit scenario' screen for a 'Legal disclaimer' scenario 26

27 Content categorisation A content categorisation scenario triggers a response on the basis of the NetIntelligence Fingerprint category to which a file or URL may belong. NetIntelligence uses a unique combination of detection tools and techniques that can identify harmful attachments or URLs. The NetIntelligence central databases contain in excess of 30 million digital fingerprints, which identify a file out of millions of other files. These fingerprints are generated from an assessment process, which involves our dedicated team of specialists physically reviewing the material and determining the categories to which the material should be assigned. The material can take various forms: images, website addresses (URLs), files, movies etc. In this example, we're defining a scenario, which we're calling 'Virus Creation Utilities attachment found', in which MailFilter will check s' attachments specifically for virus creation utilities (Figure 28). Figure 28: The 'Edit scenario' screen for a 'Content categorisation' scenario As you can see, all of the categories of threatening or inappropriate content that MailFilter can recognise are listed. As our example deals specifically with detecting virus creation utilities attached to s, we need to check only the 'Virus Creation Utilities' checkbox. Clicking the 'save' button will store the details of your new scenario. 27

28 Text analysis A text analysis scenario triggers a response on the basis of specified text that appears in an message. This scenario type works in conjunction with MailFilter's 'Phrase Lists'. Phrase Lists are lists of words or phrases that you want MailFilter to detect in . When you configure this type of scenario, you specify which Phrase List that MailFilter should consult when processing . Creating a Phrase List MailFilter has a set of predefined phrase lists, which you can use in a text analysis scenario for filtering . You can view existing Phrase Lists by clicking on the 'Phrase Lists' link in the menu. MailFilter's predefined lists are shown under 'SHARED PHRASE LISTS' below (Figure 29): Figure 29: The 'Phrase Lists' screen These lists contain words and phrases commonly found in unwanted , including pornographic and pharmaceutical phrases. You can also create your own custom phrase lists. The examples shown above ('Blocked Phrases' and 'Monitored Phrases') are custom phrase lists. 28

29 To create a new phrase list, click on the 'new' button. The 'New phrase list' screen is then displayed (Figure 30): Figure 30: The 'New phrase list' screen The name and description are entered in the usual way. Click 'save' to display the 'Edit Phrase List' screen (Figure 31): Figure 31: the 'Edit Phrase List' screen To add words or phrases to your new list, simply enter them into the text box provided. As stated on screen, you can add a set of words or phrases, as long as they are separated by either commas, or tabs, or carriage returns (Figure 32): Figure 32: Words/phrases added to this phrase list When you have entered all the words and phrases you want to add to the list, click the 'add' button. You will see that these words and phrases have now been added to the list at the left of the screen. 29

30 You can delete words and phrases from the list simply by clicking the red 'target' button in the 'Delete' column (Figure 33). Figure 33: The 'Delete' button Using a Phrase List in a Text Analysis Scenario Once you've created your phrase list, it becomes available in the configuration options for the text analysis scenario. To create a new text analysis scenario, back in the '- scenarios' screen, select 'Text analysis' from the 'Add new scenario' drop-down list, and click the 'new' button. In this example, we're defining a scenario, which we're calling 'Howie Ltd phrase list entry found', in which MailFilter will check the content of s for words and phrases contained in 'Howie Ltd custom phrase list' (Figure 34). Figure 34: The 'Edit scenario' screen for a 'Text analysis' scenario After naming your new scenario, all you have to do is to select your chosen phrase list from the 'References' drop-down list (Figure 34), and click the 'save' button. 30

31 Unsolicited identifier This type of scenario triggers a response on the basis of the identification of 'spam' (or unsolicited ). MailFilter provides several mechanisms for identifying spam , for example by detecting hidden tracking codes and hyperlink tracking codes, and also uses structural and heuristic analysis. This type of scenario can also use online blocking lists, which are blacklists containing various internet resources used for the purposes of producing spam. In this example, we're defining a scenario, which we're calling 'Spam found', in which MailFilter will process s using the techniques mentioned above, in order to determine whether or not they are spam . To configure this scenario, click on the checkbox(es) of the option(s) you want MailFilter to use when identifying spam, then click the 'save' button (Figure 35). Figure 35: The 'Edit scenario' screen for an 'Unsolicited identifier' scenario The first seven options listed here are spam-identification mechanisms proprietary to MailFilter: Detection of Hidden tracking codes these are concealed tracking mechanisms embedded into HTML, usually in images. When the user views the image, a message is sent back to the sender, identifying the user's address as active. Detection of Hyperlink tracking codes these are very similar to the previous mechanism, but are not concealed. An example of this is a 'Click here to unsubscribe' link in an . Structural Analysis this type of spam identification looks at the structure of the , for deviations from standard structure, which often occur in spam . Heuristic analysis this type of spam identification looks at the body, for attempts by spammers to circumvent anti-spam measures (for example using lines of random text). 31

32 Detection of Image spam this kind of spam is characterised by the entire content of the message being presented in an image, which again can be an attempt by spammers to circumvent anti-spam measures. IP rules - MailFilter lists IPs that are known sources of spam . Fingerprinting - MailFilter lists digital fingerprints of elements typically contained in spam s. The remaining options are all third party DNS blocking lists. Remember that the default anti-spam policy is already configured to block spam. You only need to do this if you want to tailor the spam filtering to your particular requirements. Utilities The ' Utilities' scenario provides extra filtering mechanisms ('utilities'), which allow you to: identify particular headers scan the 's HTML parts for the presence of specific text scan the 's plain text parts for the presence of specific text For this scenario type, you select the utility type, and provide the text that the utility should search for. In this example, we want to search the 's HTML to find an image tag (<IMG>) (Figure 36). Figure 36: The 'Edit scenario' screen for an ' Utilities' scenario In the 'Add new item' drop-down list, select the utility type you want to use, then in the adjoining text box, enter the text that you want to search for. Click 'add' to add this item. You'll see that the item you have just created has now been added to the list (as shown above). Now that you've set up the all scenarios that you wish to identify, you can go ahead with creating responses to pair with the scenarios. 32

33 3.3.2 Creating Responses To create a MailFilter response, click on the '- responses' link in the menu. The 'Responses' screen will be displayed (Figure 37): Figure 37: The 'Responses' screen MailFilter provides a preset policy to get you started the Default anti-spam policy. This policy is made up of rules which use the scenarios and responses you will see when you first use the Scenarios and Responses screens. The responses Bounce and Archive, Deliver, Log and Quarantine, shown here, are all predefined by MailFilter. Click the 'new' button. The 'New Response' screen will then be shown (Figure 38). Figure 38: The 'New Response' screen 33

34 Enter the name and description of the response you're creating, as already described for creating scenarios (on p21). Click 'save', and the 'Edit Response' screen will be displayed (Figure 39): Figure 39: The 'Edit Response' screen In this example, we're creating a new response called 'Strip Attachment', which will simply strip the attachment from any . Responses can have 'actions' attached to them. These actions are predefined by MailFilter, and are selected in the 'Add new Action' section. Table 1: MailFilter 'actions' Action Add header: Archive in: Cancel archiving in: Description This action adds a header to an . This action allows you to create a copy of messages and attachments. You will be required to enter the name of the archive folder you wish to send items to. A list of possible locations is given below the 'additional detail field'. If no archive is specified, the MailFilter will create and use its '\Archive\defaultarchive' directory. This action cancels archiving of the message. It overrides any other archiving actions (which may be applied for example due to the application of multiple policies to a group or account). 34

35 Action Append mailfilter toolbar Block Bounce Deliver Append disclaimer Forward to: Log Notify recipient Notify sender Quarantine Remove attachment Send report to: Sterilize HTML Tag (prefix subject line) Description This action adds the MailFilter toolbar to an . The MailFilter toolbar is a set of controls which allows you to identify a particular as 'spam' or 'not spam'. (This feature should be used by more advanced users of MailFilter.) This action simply stops the message getting beyond the NetIntelligence MailFilter to the recipient. It does not have any configuration options. This action returns a message to the sender stating that the message was not deliverable. The message does not specify the reason for the failure to deliver. This option is also not configurable. This action allows the delivery of the message to the intended recipient. It overrides any other 'Block', 'Quarantine' or 'Bounce' actions (which may be applied for example due to the application of multiple policies to a group or account). This action appends disclaimer text to the message. Please contact NetIntelligence Support to add disclaimer text. This action blind copies (Bcc's) the message to an additional recipient. You can specify which additional recipient is to receive the messages. This action logs the sender, recipient, subject, size and date of the . This information is used by the reporting and analysis tools. This action sends an based on a template to the recipient of an . Please contact NetIntelligence Support to add a notification . This action sends an based on a template to the sender of an . Please contact NetIntelligence Support to add a notification . This action sends a message to a quarantine location. The message will be stored in quarantine until an authorised user determines how the message is to be dealt with. Quarantined messages can be accessed via the 'Quarantine Manager' (see Quarantine Manager on p9 for more information on this). This action removes the attachment from a message. There are no configuration options for this action type. This action sends a report to a specified address. The report contains the details of the scenario which caused the message to be reported, along with a copy of the message and attachment. Selecting which account is to receive the report is a configuration option in this action type. This action removes the sections of HTML in messages which report that addresses are active. This kind of tracking is a common technique used by spammers, and removal of these sections of HTML means that spammers cannot find out whether your address is active or not. There are no configuration options within this action type. This action places your selected 'tag' text at the beginning of the 'Subject' line of an . Some of these actions are straightforward and need no further information to be provided by you to MailFilter - you simply check the radio button alongside the action. However, others require additional information to be provided by you. When you select any of these actions, you will have to give the additional information in the 'Additional detail ' field provided. 35

36 Table 2: Actions requiring additional information Action Add Header: Archive in: Cancel archiving in: Append disclaimer: Forward to: Send report to: Tag (prefix subject line) Additional information to be supplied The header to add Archive folder (chosen from on-screen list) Archive folder (chosen from on-screen list) Selection of disclaimer (chosen from on-screen list) Forwarding address address to send the report to Text that you want to appear as a prefix in the 'Subject' line When you have selected an action, click the 'add' button. The screen will change, showing your selected action in a new list, at the top of the shaded area of the screen (Figure 40): Figure 40: An action added to the response The list provides a 'Delete' option against each entry, if later you want to delete the action from the response. You can add as many actions as you require to the response these will all be listed as they are added. When you have finished adding actions, click the 'save' button to return to the 'Responses' screen, where you will now see your new response listed with the other existing responses. Repeat this process for all the responses that you wish to create. When you have done this, you are ready to create the policies which you're going to apply to accounts and groups. 36

37 3.3.3 Creating Policies Now that your scenarios and responses have been created, you are ready to pair them together as rules in a policy. Policies are created using MailFilter's 'Policy Manager'. To open the Policy Manager, click the 'Policy' link in the menu. The Policy Manager screen is displayed (Figure 41): Figure 41: The 'Policy Manager' screen To create a new policy, click the 'new' button. The 'New Policy' screen will be displayed: Figure 42: The 'New Policy' screen The name and description are entered as described for the other screens. The 'Type:' drop-down list allows you to specify the policy type, i.e. whether the policy is to apply to incoming or to outgoing s. Click 'save', and the 'Edit Policy' screen will be shown (Figure 43): Figure 43: The 'Edit Policy' screen 37

38 Here, you can set up rules for the policy. For each rule, specify a scenario using the 'Add a new scenario' drop-down list, and a response using the 'and its response' drop-down list. Click the 'add' button to add the rule to the policy. Repeat this process for each rule you want to add to the policy. Note that when a scenario or a response has been used in a rule in a policy, it cannot be edited. You will have to remove the rule from the policy if you want to change the scenario or response you can then add the rule to the policy again. Click 'save' when you have added all the rules you need to your policy. You'll see that your new policy now appears in the list of policies in the 'Policy Manager' screen. Now that you have created policies, the next step is to apply these policies to accounts or domains. 38

39 3.3.4 Applying Policies To apply a policy, click on the 'Accounts' link in the menu. The ' Addresses and Domains' screen will be shown (Figure 44): Figure 44: The ' addresses and domains' ('Accounts') screen As discussed earlier (page 17), each entry in the table shown can have an incoming policy ('Policy In'), an outgoing policy ('Policy Out') or both kinds of policy applied to it. Click the green 'target' button under the 'Edit/View' column, next to the account or group which you wish to apply the policy to. The 'Edit Group' or 'Edit Account' screen will be shown, as appropriate (Figure 45): Figure 45: The 'Edit group' screen You can apply a policy to messages that are sent from the group/individual account using the 'Incoming Policy' drop-down list, and to messages sent to the group/individual account using the 'Outgoing Policy' drop-down list. Once you have done this, click the 'save' button. You'll see that now the group or account is listed with the policies you have just applied. 39

40 Note that the 'Accounts in this group' section lists the individual accounts that you have set up in MailFilter, that you have added to this group. You have now done all the configuration required to use your own tailored policies with MailFilter. 40

41 4 Questions and Answers This section deals with common questions concerning use of MailFilter within an organisation, and describes some common tasks within MailFilter. Q. How do I view in quarantine? A. Click the 'Today', 'This Week', or 'All' buttons on the 'Home' page. To search for specific items in quarantine, click the 'Quarantine' button in the menu. Q. How do I block more spam? A. Click 'Scenarios' in the menu, then edit the "Identify Spam" scenario. Here you will see a list of the currently available anti-spam options. You can increase or decrease the level of spam blocking by selecting/deselecting options in this list. Please refer to NetIntelligence support for guidance on which options to use, if you are in any doubt. Q. How do I block from a specific sender address? A. From the 'Home' page, click the 'View' button to edit your blacklist. Add the specified address or domain to the list, then click 'save'. Q. How do I add a new domain to the filter? A. Our support staff will be happy to add new domains for you. Please contact NetIntelligence support using the details provided in section 5, Contact Details. Q. How can I monitor s sent from a specific address? A. Create an "address list" scenario containing the address(es) you wish to monitor. Create a response containing the appropriate actions for these monitored s (e.g. archiving a copy of the , or forwarding a copy to another address). Add this scenario and response as a new rule in your policy applied to inbound . Q. How can I monitor s sent to a specific address? A. Follow the instructions as above, but add the rule to a sender/outbound policy. Q. How do I apply different rules to specific addresses? A. Create a new policy with the required rules. In the 'Accounts' section, add the required addresses and apply the new policy to them. 41

42 Q. Can I make changes to the AV settings? A. No, AV scanning is applied globally, and is not controlled through the policy mechanism. So nothing you do in your policy will stop s from being virus scanned. Q. Can I change what happens to AV notification s? A. Your filtering policy can be configured to block s from which a virus has been removed. The "AV notifications" scenario does this. If you want to prevent AV notification s being sent, include this scenario with a 'block' response in your policy. 42

43 5 Contact Details NetIntelligence support information If you require any technical support, please call: am pm Mon-Fri or support@netintelligence.com NetIntelligence sales information For NetIntelligence, Services, Co-location sales, please call: am pm Mon-Fri Business address information Netintelligence Ltd Lister Building Block 9 Kelvin Campus West of Scotland Science Park Glasgow G20 0SP 43

44 Appendix A: Example Reports Figure 46: The 'Spam Summary' report 44

45 Figure 47: The ' Traffic Summary' report 45

46 Figure 48: The 'Top Recipient' report 46

47 Figure 49: The 'Top Sender' report 47

48 Figure 50: The 'Biggest s' report 48