Ensure Zero-day protection is enabled for Email Protection and set to MTA mode

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

This configuration option is only applicable when the device is configured with 'MTA mode' and set 'Sophos' as primary malware scanning engine. Navigate to 'Protect > Email'. Verify the existing SMTP policy 'Malware protection > Scanning > Single anti-virus (this set the scan engine to Sophos ) is set and Selected antivirus action' to 'Drop'. Email attachment successfully verified by antivirus engine as malicious should be set to 'Drop'. (Full steps: CIS 4.3.)

修复方式

修复方法: 操作指南或基础设施补丁

This configuration option is only applicable when the device is configured with 'MTA mode' and set 'Sophos' as primary malware scanning engine. Navigate to 'Protect > Email'. Verify the existing SMTP policy and set 'Malware protection > Scanning > Single anti-virus( this set the scan engine to Sophos) is set and Selected antivirus action' to 'Drop'. Email attachment successfully verified by antivirus engine as malicious should be set to 'Drop'. 'Quarantine unscannable content' is checked to prevent files with multiple layers of compression and password protected archives files that cannot be scanned by antivirus engine should be 'quarantined'. Set 'Use zero-day protection' is checked