Mail quarantine

Manage quarantined emails

New article: 10.2022

notempty

This article refers to a Resellerpreview

-

Introduction

The UTM's email section stores emails that

are in quarantine due to a mailfilter rule
or
whose content has been captured by the URL filter.

Features:

Listing of which emails are in quarantine
If applicable: list of which emails were delivered
View quarantined emails
Download attachments
Redeliver emails
Statistics

Especially the possibility to resend emails requires a very conscientious check if these emails are free of unwanted malicious code!

Regular users are shown only emails from their own mailbox.
Mailfilter administrators have access to all mailboxes here.

The configuration for this must be done in the admin interface under the menu.
There, in the Settings tab, you can configure whether unobjected emails

with meta information only

are also listed here(Save all email transactions), how long emails are kept here, with what replacement text criticized content, URL and viruses are replaced and when a spam report is sent.

     | }}-->

Login to the user interface

The user login to the user interface is called up via the IP address or URL of the UTM, possibly followed by a port specification
Depending on the assigned permissions, various functions are made available
Click on the corresponding tile to access the desired function

Configured	Port	Example call with IP	Example call with URL
Default	443	i.e. https://192.168.175.1	i.e. https://utm.ttt-point.de
Port changed bei administrator Menu: Network / Appliance Settings / Appliance Settings / Webserver / User Webinterface Port	4443	i.e. https://192.168.175.1:4443	i.e. https://utm.ttt-point.de:4443

The responsible admin must provide the IP address or domain name and, if necessary, the port for the user web interface

After entering the IP address, the user login page of he Securepoint UTM is loaded. The login credentials are entered there.

Value	Description	The login window User Login with the two and the optional third input box.
User	Username
Password	The associated password
OTP Code Optional	If this input box is displayed, a one-time password (OTP) must be entered The one-time password (OTP) is an authentication mechanism that provides additional security when a user logs in. The code to create OTPs must be supplied by the administrator
Login	You can log in to the user interface by clicking on this button after entering all login data correctly.

Mail quarantine

Mailbox

This area displays an overview of all quarantined emails. The emails can be filtered or sorted by their sender, recipient, date of receipt, subject and labeling (click on the respective column header).

Caption	Value		Description
Sender	All		No restriction
	Sender missing		Shows only emails without sender
	charles@anyideas.de		Only shows emails to the selected sender. In this case all emails from charles@anyideas.de.
Recipient	All		This filter is used to filter the mails according to the selected recipient.
	Recipient missing		Shows only emails without recipient
	alice@ttt-point.de		Only shows emails to the selected recipient. In this case all emails to alice@ttt-point.de.
Date	01.09.2022	30.09.2022	The display can be limited to a date or a time frame. A click into the respective field opens a calendar with selection dialog.
Subject			The emails are filtered according to the entered subject
Labeling	Accepted Delivered Temp-quarantine Quarantine Discarded Rejected Tagged Filtered Virus		This column displays actions performed and the email protocol used

Filtered mails in the mailbox

Exemplary representation of a filtered mail in the mailbox.

In the user management, the administrator can configure under → Authentication →UserTab Mailfilter whether downloading or forwarding (resending) of attachments or emails is allowed for the user or not.

In the table header and on the far left of each mail is a checkbox .
If the checkbox in the table header is clicked , all emails in the table that can be redelivered (emails that have not been discarded, rejected or already accepted) are selected.
Alternatively, the respective emails can also be selected differently using the checkbox to the left of each email.

Afterwards, the emails highlighted in this way can be sent using the button on the left under the table Send again.

Email details

The screenshot shows an email with two attachments, one of which (eicar) contains a virus.
In the user administration the following permissions have been configured by the administrator under Tab Mailfilter:
Allow download of the following attachments:
Allow forwarding of the following emails:

If you wish to read a filtered out mail in the quarantine box, click on the 'Open email' button. A new window will open with the content of the opened email. Refer to the figure.

If the mouse is hovered over the attachment, a text box appears with further information about this attachment. Besides the name and the MIME type of the attachment, a short info about the attachment is also displayed. Additionally, it informs whether the user is authorized to open this attachment.

The displayed hover text box at the attachment of the sample email No Viral infection 2! from viral@anyideas.de. The left attachment is downloadable for the user, but the faded right attachment is not.

Resend email/s

Resend is available for emails with the tag:

Filtered
Quarantine

Emails that have been discarded, rejected or already successfully delivered cannot be redelivered.
An opened email can be resend individually or several highlighted emails can be resend at the same time. After clicking the Send again button, the following dialog appears:

Besides the default setting Original recipients, the possible other recipients are also displayed

The default setting in the Resend email/s window.

Under Recipients:, Original recipients is selected by default. Then all selected emails or the opened email will be send to their original recipients.
Alternatively, a specific arbitrary e-mail address is selected. Then a delivery is made to this selected recipient.
After selecting the recipient, click Send again to confirm the operation.

It must be ensured that resend emails are free of unwanted malicious code.
These emails do not pass through the mailfilter again.

Statistics

Example statistics

The statistic shows a temporal overview of all emails for 30 days. These mails are categorized according to their tags.

Mailfilter administrators can select here whether they want to display statistics about all users or only for a specific mailbox.