Trend Micro Incorporated reserves the right to make changes to this document and to the service described herein without notice. Before installing and using the service, review the readme files, release notes, and/or the latest version of the applicable documentation, which are available from the Trend Micro website at: https://docs.trendmicro.com/en-us/enterprise/email-security.aspx Trend Micro, the Trend Micro t-ball logo, Remote Manager, Apex Central, Cloud App Security, and Hosted Email Security are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright © 2021. Trend Micro Incorporated. All rights reserved. Document Part No.: APEM09182/210104 Release Date: September 9, 2021 Protected by U.S. Patent No.: Patents pending. This documentation introduces the main features of the service and/or provides installation instructions for a production environment. Read through the documentation before installing or using the service. Detailed information about how to use specific features within the service may be available at the Trend Micro Online Help Center and/or the Trend Micro Knowledge Base. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at [email protected]. Evaluate this documentation on the following site: https://www.trendmicro.com/download/documentation/rating.asp Privacy and Personal Data Collection Disclosure Certain features available in Trend Micro products collect and send feedback regarding product usage and detection information to Trend Micro. Some of this data is considered personal in certain jurisdictions and under certain regulations. If you do not want Trend Micro to collect personal data, you must ensure that you disable the related features. The following link outlines the types of data that Trend Micro Email Security collects and provides detailed instructions on how to disable the specific features that feedback the information. https://success.trendmicro.com/data-collection-disclosure Data collected by Trend Micro is subject to the conditions stated in the Trend Micro Privacy Notice: https://www.trendmicro.com/privacy Table of Contents About Trend Micro Email Security .......................................... 1 What's New ..................................................................... 1 Service Requirements .................................................... 15 Features and Benefits ..................................................... 17 Available License Versions ............................................. 20 Inbound Message Protection .......................................... 22 Inbound Message Flow ............................................ 23 Outbound Message Protection ........................................ 24 Integration with Trend Micro Products ........................... 25 Apex Central ........................................................... 25 Trend Micro Remote Manager .................................. 27 Getting Started with Trend Micro Email Security ................... 28 Accessing the Trend Micro Email Security Administrator Console ......................................................................... 28 Provisioning a Trend Micro Business Account ................. 31 Setting Up Trend Micro Email Security ...................... 33 Working with the Dashboard ................................................ 34 Threats Tab ................................................................... 37 Ransomware Details Chart ....................................... 38 Threats Chart .......................................................... 38 Threats Details Chart ............................................... 41 Virtual Analyzer File Analysis Details Chart ............... 43 Virtual Analyzer URL Analysis Details Chart .............. 44 Virtual Analyzer Quota Usage Details ........................ 46 Domain-based Authentication Details Chart .............. 47 Blocked Message Details .......................................... 48 Top Statistics Tab ........................................................... 51 Top BEC Attacks Detected by Antispam Engine Chart ............................................................................... 51 Top BEC Attacks Detected by Writing Style Analysis Chart ...................................................................... 51 Top Targeted High Profile Users ................................ 52 i Trend Micro Email Security Administrator's Guide Top Analyzed Advanced Threats (Files) Chart ............ 53 Top Analyzed Advanced Threats (URLs) Chart ........... 53 Top Malware Detected by Predictive Machine Learning Chart ...................................................................... 54 Top Malware Detected by Pattern-based Scanning Chart ............................................................................... 54 Top Spam Chart ....................................................... 55 Top Data Loss Prevention (DLP) Incidents Chart ........ 55 Other Statistics Tab ........................................................ 56 Volume Chart .......................................................... 56 Bandwidth Chart ..................................................... 57 Time-of-Click Protection Chart ................................. 58 Managing Domains .............................................................. 59 Adding a Domain ........................................................... 61 Configuring a Domain .................................................... 63 Adding SPF Records ................................................. 69 Adding Office 365 Inbound Connectors ..................... 70 Adding Office 365 Outbound Connectors ................... 73 Editing or Deleting Domains .......................................... 76 Inbound and Outbound Protection ....................................... 77 Managing Recipient Filter .............................................. 77 Managing Sender Filter .................................................. 77 Sender Filter Settings ............................................... 78 Configuring Approved and Blocked Sender Lists ........ 79 Transport Layer Security (TLS) Peers .............................. 85 Adding Domain TLS Peers ........................................ 88 Editing Domain TLS Peers ........................................ 90 Understanding IP Reputation ......................................... 90 About Quick IP List .................................................. 91 About Standard IP Reputation Settings ...................... 93 About Approved and Blocked IP Addresses ................ 94 IP Reputation Order of Evaluation ............................ 95 Troubleshooting Issues ............................................ 96 Domain-based Authentication ........................................ 97 Sender IP Match ...................................................... 98 Sender Policy Framework (SPF) .............................. 100 DomainKeys Identified Mail (DKIM) ........................ 105 ii Table of Contents Domain-based Message Authentication, Reporting & Conformance (DMARC) .......................................... 112 How DMARC Works with SPF and DKIM .................. 119 File Password Analysis ................................................. 120 Configuring File Password Analysis ......................... 121 Adding User-Defined Passwords .............................. 122 Importing User-Defined Passwords ......................... 122 Configuring Scan Exceptions ........................................ 123 Scan Exception List ................................................ 123 Configuring "Scan Exceptions" Actions .................... 125 High Profile Users ........................................................ 127 Configuring High Profile Users ............................... 127 High Profile Domains ................................................... 130 Configuring High Profile Domains .......................... 130 Configuring Time-of-Click Protection Settings ............... 132 Data Loss Prevention .................................................... 133 Data Identifier Types .............................................. 134 DLP Compliance Templates .................................... 146 Configuring Policies ........................................................... 149 Policy Rule Overview .................................................... 151 Managing Policy Rules ................................................. 152 Reordering Policy Rules ............................................... 154 Naming and Enabling a Rule ......................................... 155 Specifying Recipients and Senders ................................ 156 Inbound Policy Rules ............................................. 156 Outbound Policy Rules ........................................... 158 About Rule Scanning Criteria ........................................ 161 Configuring Virus Scan Criteria .............................. 163 Configuring Spam Filtering Criteria ........................ 166 Configuring Data Loss Prevention Criteria ............... 175 Configuring Content Filtering Criteria ..................... 176 About Rule Actions ....................................................... 192 Specifying Rule Actions .......................................... 193 Intercept Actions ..................................................