Trend Micro Deep Discovery Email Inspector 3.0 Administrator's Guide

Trend Micro Incorporated reserves the right to make changes to this document and to the product described herein without notice. Before installing and using the product, review the readme files, release notes, and/or the latest version of the applicable documentation, which are available from the Trend Micro website at: http://docs.trendmicro.com/en-us/home.aspx/ Trend Micro, the Trend Micro t-ball logo, OfficeScan, Control Manager, and Deep Discovery are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright © 2017. Trend Micro Incorporated. All rights reserved. Document Part No.: APEM37857/170505 Release Date: October 2017 Protected by U.S. Patent No.: Patents pending. This documentation introduces the main features of the product and/or provides installation instructions for a production environment. Read through the documentation before installing or using the product. Detailed information about how to use specific features within the product may be available at the Trend Micro Online Help Center and/or the Trend Micro Knowledge Base. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at [email protected]. Evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Table of Contents Preface Preface ................................................................................................................. ix Documentation ................................................................................................... x Audience ............................................................................................................. xi Document Conventions ................................................................................... xi About Trend Micro .......................................................................................... xii Chapter 1: Introduction About Deep Discovery Email Inspector .................................................... 1-2 What's New ............................................................................................. 1-2 Features and Benefits ............................................................................. 1-7 A New Threat Landscape ........................................................................... 1-11 Spear-Phishing Attacks ........................................................................ 1-12 C&C Callback ....................................................................................... 1-12 A New Solution ............................................................................................ 1-13 Virtual Analyzer .................................................................................... 1-14 Advanced Threat Scan Engine ........................................................... 1-14 Predictive Machine Learning .............................................................. 1-15 Web Reputation Services ..................................................................... 1-15 Social Engineering Attack Protection ............................................... 1-16 Trend Micro Control Manager ........................................................... 1-16 Chapter 2: Getting Started Getting Started Tasks ..................................................................................... 2-2 Configuring Management Console Access ................................................. 2-4 Opening the Management Console ............................................................. 2-6 System Requirements ............................................................................. 2-7 Management Console Navigation ........................................................ 2-8 i Trend Micro Deep Discovery Email Inspector Administrator's Guide Chapter 3: Dashboard Dashboard Overview ..................................................................................... 3-2 Tabs ................................................................................................................... 3-3 Predefined Tabs ...................................................................................... 3-3 Tab Tasks ................................................................................................. 3-4 New Tab Window .................................................................................. 3-4 Widgets ............................................................................................................. 3-6 Adding Widgets to the Dashboard ...................................................... 3-6 Widget Tasks ........................................................................................... 3-6 Overview .................................................................................................. 3-8 Threat Monitoring ................................................................................ 3-12 Top Trends ............................................................................................ 3-15 System Status ......................................................................................... 3-22 Virtual Analyzer .................................................................................... 3-24 Chapter 4: Detections Detected Risk .................................................................................................. 4-2 Email Message Risk Levels ................................................................... 4-2 Virtual Analyzer Risk Levels ................................................................. 4-4 Threat Type Classifications ........................................................................... 4-5 Exporting Search Results .............................................................................. 4-6 Detected Messages ......................................................................................... 4-7 Viewing Detected Messages ................................................................. 4-8 Investigating a Detected Message ...................................................... 4-13 Viewing Affected Recipients .............................................................. 4-15 Viewing Attack Sources ....................................................................... 4-17 Viewing Senders ................................................................................... 4-18 Viewing Email Subjects ....................................................................... 4-20 Suspicious Objects ....................................................................................... 4-21 Viewing Suspicious Hosts ................................................................... 4-22 Viewing Suspicious URLs ................................................................... 4-23 Viewing Suspicious Files ..................................................................... 4-24 Viewing Synchronized Suspicious Objects ...................................... 4-25 ii Table of Contents Quarantine ..................................................................................................... 4-26 Viewing Quarantined Messages ......................................................... 4-26 Investigating a Quarantined Email Message .................................... 4-31 Sender Filtering ............................................................................................. 4-34 Viewing Sender Filtering Detections ................................................. 4-34 Chapter 5: Policies About Policies ................................................................................................. 5-2 General Message Scanning Order ........................................................ 5-3 Policy Management Guidelines ............................................................ 5-4 Policy Matching ....................................................................................... 5-5 Policy Splintering .................................................................................... 5-7 Policy List ......................................................................................................... 5-8 Configuring a Policy ............................................................................... 5-9 Address Groups .................................................................................... 5-12 Policy Rules .................................................................................................... 5-16 Content Filtering Rules ........................................................................ 5-16 Antispam Rules ..................................................................................... 5-22 Threat Protection Rules ...................................................................... 5-26 Policy Objects ............................................................................................... 5-29 Notifications .......................................................................................... 5-30 Message Tags ......................................................................................... 5-32 Redirect Pages ....................................................................................... 5-33 Policy Exceptions ......................................................................................... 5-34 Configuring Message Exceptions .....................................................

Load more