Reference Guide McAfee Security for Microsoft Exchange 8.6.0
COPYRIGHT Copyright 2017 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
Contents 1 Scanning 5 2 Graph 7 3 Product versions and updates 9 Update information.................................. 9 Product information................................. 10 Licenses...................................... 10 4 View recently scanned items 11 5 Policy Manager menu options 13 Index 37 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 3
Contents 4 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
1 Scanning Displays information on the total items scanned by MSME and the average time taken to scan all items, since the last reset. Table 1-1 Option definitions Option Average Scan Time (milliseconds) Total Scanned Definition Specifies the average time taken by MSME to scan all the email messages that reach the Exchange server. To understand how this is calculated, let's consider this example where: T = Total time taken to scan all emails after the last MSME Service restart. N = Total number of emails scanned after the last MSME Service restart. then, Average scan time = T/N (in milliseconds) Total number of email messages scanned, since the last time the statistic counters were reset. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 5
1 Scanning 6 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
2 Graph Displays the statistics of the email messages scanned by MSME in a graphical format. Table 2-1 Icons used Graph section Icon Description View statistical information of the selected counters as a bar graph. This is useful when you want the statistics of total number of emails scanned and the items that triggered a detection during the selected duration. View statistical information of the selected counters as a pie chart. This is useful when you want the percentage of emails scanned and the items that triggered a detection during the selected duration. Table 2-2 Option definitions Option Graph Definition Spam Summary Provides additional information on how many spam email messages were detected and blocked by MSME for the selected time range. Phish Summary Provides additional information on how many phishing email messages were detected and blocked by MSME for the selected time range. Magnify Graph Specify the magnification percentage of the Detections graph. This helps you view an enlarged graph, which is useful when the default graph in the dashboard is cluttered with more information and becomes unreadable in the current browser window. Time range Specify for which time period you would like to review the statistics. The available options are: Last 24 Hours Last 7 Days Last 30 Days McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 7
2 Graph 8 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
3 Product versions and updates Provides important information on whether the software is up-to-date with all the latest DATs and drivers. It also provides information about the product license type and if any additional components are installed. Versions and Updates The Versions & Updates section in the Dashboard has these tabs: Update Information Product Information Licenses Contents Update information Product information Licenses Update information Provides information about anti-virus DAT, anti-virus engine, extra drivers, anti-spam engine version, their status and when they were last updated. MSME uses the McAfee update website to automatically update its anti-virus DAT, engine and rules on a daily-basis. If MSME is managed by an epolicy Orchestrator server, create an AutoUpdate task using epolicy Orchestrator. Table 3-1 Option definitions Update Information Option Last Successful Update Update Now Update Frequency Edit Schedule Show Status Anti-Virus Engine DAT Version Extra Drivers Definition Displays the time when the software was updated successfully. Click to immediately update the product with latest engine and drivers. This is helpful in a situation when there is a virus out-break and you cannot wait until the scheduled software update occurs. Displays the schedule frequency of how often the software is updated. Click to schedule or edit the product's software update. For more information on how to update the software, see Schedule a software update section. Click to view the status of the update task such as the start time, running time, current status and how much the task has progressed. Displays the latest anti-virus engine, DAT version and extra drivers information and when it was updated. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 9
3 Product versions and updates Product information Table 3-1 Option definitions Update Information (continued) Option Viruses that Extra Drivers Detect Anti-Spam Engine Rules Version Definition Displays items that were detected by ExtraDAT to remove particular viruses. EXTRA.DAT files contain information that is used by MSME to detect a new virus. When a major virus is discovered and extra detection is required, an EXTRA.DAT file is made available until the normal DAT update is released. Displays the anti-spam engine and rules version number and when it was updated. This appears only if the McAfee Anti-Spam add-on component is installed. Product information Provides information on the product name, version, service packs, hotfixes, and any additional component installed. Table 3-2 Option definitions Option Product Name Product Version Service Pack Hotfixes Definition Specifies McAfee Security for Microsoft Exchange as the product name. Specifies the product version in the format: 8.5.<build number>.<package number> Lists the Service Pack or Patch details (if any) Lists the hotfixes installed Licenses Provides information on the type of license, expiration date, and days to expire of the installed product and components. License information of McAfee Anti-Spam add-on component appears if you have it installed or activated. Table 3-3 Option definitions Option Description Definition Specifies the installed product name. McAfee Anti-Spam for McAfee Security for Microsoft Exchange appears, if you have the McAfee Anti-Spam add-on component installed. Type Expires Specifies if the installed product is a Licensed or Evaluation version. Appears when you have an Evaluation version of the software installed. Specifies the date and time on when the license expires. Days to Expiry Appears when you have an Evaluation version of the software installed. Specifies the number of days remaining for product expiry. 10 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
4 View recently scanned items Provides a quick view of the recently scanned items from the dashboard. The Recently Scanned Items section provides you run-time information on all items scanned by MSME. By default, only 10 items appear in the Recently Scanned Items section. However, you can view up to 100 items by modifying the Maximum recently scanned items option under Settings & Diagnostics User Interface Preferences Dashboard Settings Report Settings. The items in the Recently Scanned Items section will be cleared, if you restart McAfee Security for Microsoft Exchange service from the Services console. Table 4-1 Option definitions Option Date/Time Definition Date and time when the most recent scan was executed. IP Reputation Score Score which reflects the likelihood that a network connection poses a threat. Sender Recipients Subject Action Taken Filename Detection Name Task Reasons Scanned By Policy Name Reputation Score Reason Email addresses of the senders of the items that were scanned. Email addresses of recipients of scanned items. Subject line of scanned emails. What action was taken on scanned items. The name of a quarantined file. The name of a detection. For example, the name of a virus. The task associated with a particular detection. A rule or rules that were triggered by a particular email. The policy setting used to scan items. The name of the policy that triggered a detection. The authenticity level of the source of the email based on up to date information available pertaining to a particular source. The reason why the email was quarantined (quarantine queue type). For detailed information on these fields, see Available primary search filters section. Indicates that the item is clean. Indicates that the item triggered one of the scanners or filters. Hover the cursor on to see which scanner or filter was triggered. If the item triggered multiple scanners or filters, only the highest priority detection is shown. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 11
4 View recently scanned items 12 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
5 Policy Manager menu options View the menu options available under Policy Manager. From the product's user interface, click Policy Manager. These menu options appear on the left-pane. Option On-Access Description Contains policies for email messages every time they are accessed, to determine if the email message contains a virus or other potentially unwanted code. On-Demand (Default) Contains policies that are activated at set intervals or on demand, to find a virus or other potentially unwanted code. On-Demand (Find Viruses) On-Demand (Remove Viruses) On-Demand (Find Banned Content) On-Demand (Remove Banned Content) On-Demand (Full Scan) Gateway Shared Resource Contains policies that are activated at set intervals or on demand, to find a virus or other Potentially Unwanted Programs (PUPs) and other possible threats. Contains policies that are activated at set intervals or on demand, and which remove viruses, Potentially Unwanted Programs (PUPs) and other possible threats. Contains policies that are activated at set intervals or on demand, to find a banned content that you do not want to appear in email messages. Contains policies that are activated at set intervals or on demand, and which remove content that you do not want to appear in email messages. For example, if an email message contains a particular word or phrase, you can set up a policy to automatically replace the content of that email message with an alert message. You can use this type of policy to prevent unwanted information entering or leaving your organization. Contains policies that are activated at set intervals to scan for viruses, spam, phishing email messages, banned/unwanted content, and other harmful codes. Contains policies for email messages every time they are accessed, to determine spam, phish, MIME files or HTML files. One common location to edit settings for scanners, filters, alerts, DLP and Compliance dictionaries, and time slots. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 13
5 Policy Manager menu options 14 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
6 DLP 6 and Compliance Scanner condition Scanning is based on Words or Phrases and File formats you specify for the new DLP and compliance scanning rule. You can also combine the rules such that it affects specific types of files or files containing such words or phrases. Words or phrases Specify the words or phrases to look for, in The rule will trigger when the following word or phrase is found. Ignore case If enabled, the rule is triggered for specified word or phrase in any case. Starts a longer word or phrase If enabled, the rule is triggered for specified text that begins with the word or phrase. Use Wildcards If enabled, the rule is triggered for the specified word or phrase that contains wildcard characters. Wildcard characters are often used in place of one or more characters when you do not know what the real character is or you do not want to type the entire name. Ends a longer word or phrase If enabled, the rule is triggered for specified text that forms the last part of the word or phrase. Specify additional contextual words or phrases From the drop-down menu, you can select: Trigger if ANY of the phrases are present Trigger if NONE of the phrases are present Trigger if ALL of the phrases are present Select within a block of and specify the number of Characters for a block to be scanned. You can type more words or phrases by clicking Add Contextual word. Specify the word or phrase in the Specify words or phrases and then click Add. File format Select Everything to select all the file categories and its subcategories. You can select multiple categories and file types within the selected categories to be matched. Selecting All in the subcategory selector overrides any other selections that might already have been made. To deselect any of the selected file type options, click Clear selections. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 15
6 DLP and Compliance Scanner condition 16 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
7 7 DLP and Compliance scanner condition Specify phrases and file formats for the DLP and Compliance scanner condition. Phrases Click New Phrase to add a new phrase to the DLP and Compliance scanner condition list. You can also click Edit to modify the existing phrase. File format Select Everything to select all the file categories and its subcategories. You can select multiple categories and file types within the selected categories to be matched. Selecting All in the subcategory selector overrides any other selections that may already have been made. To deselect any of the selected file type options, click Clear selections. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 17
7 DLP and Compliance scanner condition 18 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
8 DLP and Compliance Scanner Rule Category Scanning is based on Words or Phrases, File formats and the level of severity you specify for the category. Table 8-1 Option definitions Option Details New Condition Definition Type a description for the DLP and Compliance scanner rule. Click New Condition to specify new word or phrase to the rule. This rule is triggered when Lists the simple phrases that the DLP and Compliance scanner will trigger when encountered during scanning. is found in Lists the condition selected for the File Format and the subcategory. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 19
8 DLP and Compliance Scanner Rule Category 20 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
9 On-Demand Task status The type of information shown in Task Status depends on the state of the scan. Some information is only shown when the scan is complete. Table 9-1 Option definitions Option Name Started Running Time Finished Current Action Progress Definition The name of the selected schedule. When the scan started. If a scan is still in progress, this field shows approximately how long the scan has been running. If the scan has finished, it shows how long it took to complete. Time is shown in hours, minutes, and seconds. If the scan is complete, this field shows when it finished. The status of the scan. How far the scan has progressed, as a percentage of the total amount of time required to complete the scan. Anti-Virus DAT version The version of the virus definition (DAT) files used when scanning items. Anti-Virus Engine Databases scanned The version of the anti-virus engine used when scanning items. Lists the databases scanned. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 21
9 On-Demand Task status 22 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
10 Policy Details View information, change the name, description, or parentage of the selected policy. Table 10-1 Option definitions Option Policy Name Description Definition To change the name of the policy. To change the description associated with the policy. Parent Policy To specify a different parent policy. Wherever the child policy has been configured to inherit settings from a parent policy, it will inherit those settings from this newly selected parent policy. All other settings that are not inherited remain the same. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 23
10 Policy Details 24 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
11 Time settings Create time-constrained configuration to create a version of the selected policy that only applies at specific times. Table 11-1 Option definitions Option Specify the category When to use this instance Create a new time slot Definition To select the type of scanner or filter that will be used by this time-constrained policy. To specify whether you want to use an existing time slot or create a new one for this time-constrained policy. You can select: Weekdays Weekends Working Hours To create a new time-constrained policy: 1 Enter a meaningful Time slot name. 2 Under Select day and time, choose the desired day(s) and then choose either All day or Selected hours one wants to put into the created time slot. 3 Click Save to apply the new settings, or click Cancel to reset the parameters. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 25
11 Time settings 26 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
12 View Settings Displays a summary of the key settings for the selected policy. Where appropriate, you can change the settings associated with the selected policy. In Policy Manager, select the policy that you want to view and configure. You can then use Selection to select the type of configuration settings you want to view and configure for the selected policy. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 27
12 View Settings 28 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
13 Report Task Status Information shown in Task Status depends on the state of the report task. Some information is only shown when the report task is complete. Table 13-1 Option definitions Option Name Started Running Time Finished Definition The name of the selected report. The date and time when the task started. If a task is still in progress, this field shows approximately how long the task has been running. If the task has finished, it shows how long it took to complete. Time is shown in hours, minutes, and seconds. If the task is complete, this field shows the date and time when it finished. Current Action The current status of the task. For example: If the task is finished, the current action shows Completed. Progress How far the task has progressed, as a percentage of the total amount of time required to complete the task. This is indicated by a progress bar. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 29
13 Report Task Status 30 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
14 On-Demand Task Status Information shown in Task Status depends on the state of the scan. Some information is shown only when the scan is complete. Table 14-1 Option definitions Option Name Started Running Time Finished Current Action Progress Definition The name of the selected schedule. The date and time when the scan started. If a scan is still in progress, this field shows approximately how long the scan has been running. If the scan has finished, it shows how long it took to complete. Time is shown in hours, minutes, and seconds. If the scan is complete, this field shows the date and time when it finished. The current status of the scan. For example, if the mailbox in the server is being scanned, it shows Scanning: - /Inbox. How far the scan has progressed, as a percentage of the total amount of time required to complete the scan. Once the scan is complete, you get more information about the scan in the same page. Anti-virus DAT version Anti-virus Engine version Results Status Total Scanned Rules broken Folders scanned The version of the virus definition (DAT) files used when scanning items. The version of the anti-virus engine used when scanning items. Lists folder names scanned. Lists the number of files Infected, Cleaned, Deleted and Quarantined. The status of the scan. The total number of files scanned. The number of rules broken during the scan. The scanned folder(s) that you selected from Available folders and placed in Folders to scan while scheduling an on-demand scan. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 31
14 On-Demand Task Status 32 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
15 Status Report Task Information shown in Task Status depends on the state of the status report task. Some information is only shown when the status report task is complete. Table 15-1 Option definitions Option Name Started Running Time Finished Definition The name of the selected status report. The date and time when the status report task started. If a status report task is still in progress, this field shows approximately how long the status report task has been running. If the status report task has finished, it shows how long it took to complete. Time is shown in hours, minutes, and seconds. If the status report task is complete, this field shows the date and time when it finished. Current Action The current state of the status report task. For example: If the status report task is finished, the current action shows Completed. Progress How far the status report task has progressed, as a percentage of the total amount of time required to complete the status report task. This is indicated by a progress bar. McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 33
15 Status Report Task 34 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
16 Update Task Status Information shown in Task Status depends on the state of the update. Some information is shown only when the update is complete. Table 16-1 Option definitions Option Name Started Running Time Finished Definition The name of the selected update task. The day, date, and time when the update started. The total time taken to complete the update. If an update is still in progress, this field shows approximately how long the update has been running. The day, date, and time when the update was complete. Current Action The current action associated with an update task. (For example: Checking update packages from repository, Completed and so on.) Progress It shows how far the update has progressed, as a percentage of the total amount of time required to complete the update (0% to 100%) and is indicated by a progress bar McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 35
16 Update Task Status 36 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide
Index I information product 10 S scanned items recently 11 L license product 9 licenses product 10 U update product 9 updates product version 9 P product license 9 update 9 product information 10 V version product 9 R recently scanned items 11 McAfee Security for Microsoft Exchange 8.6.0 Reference Guide 37
0-00