SBG培训.ppt

* 病毒库更新是通过https下载，而快速响应病毒库是通过FTP下载。所以如果需要启用快速响应更新，需要确定SBG能够通过FTP端口访问Internet。 * * * * * * 审核日志记录的是所有SBG处理过的邮件。如果邮件处理正常，那么“判断”和“已传送至”都应该能够显示正确的信息。 “判断”有时会出现值为空的情况(不是None，None代表邮件正常转发)，通常是以下原因： 邮件还没有被处理完；如果显示的时间与当前很接近，那有可能是该邮件正在处理中，过一段时间再察看就会正常 邮件没有完全到达SBG；比如邮件大小超过了SBG的限制，网络原因导致邮件没有发送完毕等，此时操作会显示“放弃” “已传送至”代表的是SBG处理后将该邮件转发到了哪里，正常邮件是目标邮件服务器，隔离邮件是SBG Control Center的地址。如果该值为None，可能原因有： 后台服务器返回邮件账户不存在，此时虽然该封邮件转发到了后台，但“已传送至”依然显示为None * 报告需要在接收邮件一段时间后才能有数据 * * * * Hold for review Allows us to implement a quarantine you just hold something so that a manual review needs to happen. And allows the reviewer to release the message or perform other actions if its approved, or perform actions that are configured if its rejected. Messages can actually be held in Incident Folders (vs. today just having an incident created.) They can be reviewed by compliance officers, and then either approved for delivery or rejected. * Configuring Hold for Review in the Control Center Didnt want to have the reviewer to have to decide what specific actions to apply (its PCI violatin, so i need to deliver w/ TLS etc) -- as part of the policy, you set up what are approved actions and what occurs when reject. so reviewer just needs to say Approve or Reject Can only have 2 actions at this level: (hold for review, and notification) -- ex SOX violation might contain financial info and its sensitive data. it may need to sent out for legitimate reaosns. but the sender needs to know that its being held. it needs to be sent, so the sender needs to know about the hold so that he can escalate - contact someone to get the message release can also be used on the inbound. Need to populate the approved actions and the rejected actions Just because it’s apprved, doesnt mean its delivered--its up the customer The only other action that can be present as a top-level action is the Send notification action. In the list of approved/reject actions there may be additional Create Incident actions. Each poli