Malware Alerting (Symantec Email Threat Detection and Response)

Products

• Email Security.cloud

Issue/Introduction

How to configure alerts/notifications for Anti-Malware service under Email Threat Detection and Response. 

Resolution

Malware Alerting (Symantec Email Threat Detection and Response)

•     Automated detection alerts for emails that are found to be malicious, after delivery
•     Ability to edit the content of notification emails
•     Notificaiton configurable for end-users and administrators
•     Ability to customize sender address for notification

The Anti-Malware service sends a detected malware alert when an incoming or outgoing email message is delivered and then is later found to contain suspected malware.

• Inbound Alerts are issued when emails that are delivered to internal users are later found to contain suspected malware.

• Outbound Alerts are issued when internal users send emails that are later found to contain suspected malware.

For each alert, you can specify whether administrators, recipients, or both receive alerts.

You can also create custom alert messages for inbound and outbound detected malware.

To configure detected malware alerts

1. Select Services > Email Services > Anti-Malware.

2. On the Alert Settings tab, Detected Malware Alert section, select Administrators or Recipient(s) as appropriate.

   • Under Inbound Alerts, check Administrators to send these alerts to all administrator emails that are configured to receive alerts. Check Recipient(s) to send alerts to the internal users to which the emails that contained the detected malware were addressed.

   • Under Outbound Alerts, check Administrators to send these alerts to all administrator emails that are configured to receive alerts. Check Recipient(s) to send alerts to the internal users who sent the emails that contained the detected malware.

3. To view the default text for inbound or outbound detected malware alerts, or to create custom alert messages, click Edit Alerts.

4. In the Detected Malware Alert Settings dialog box, when Default is selected, you can view, but not edit, the default alert messages.

   To use the default messages, click Cancel.

   To customize an alert message, change Default to Custom. You can now edit the subject line and body text of the selected message or replace the text completely. You can also choose placeholders from the dropdown list to insert variables into the alert emails. These variables are replaced by data before the alerts are sent.

   See About placeholders in malware alerts

5. When you finish editing alerts, click Save.

6. At the bottom of the Alert Settings tab, click Save.