Integration of Messaging Gateway with threat defense - coordinating the verdicts and actions

Products

• Messaging Gateway

Issue/Introduction

1. An email comes from internet to the local domain(s) Symantec Messaging Gateway (SMG) scanner and hits first the Policy "AM-Delete inbound Spam". This policy will fire the action to delete the spam email. 
2. Since the email contains a PDF attachment, it receives then the second verdict for Policy "Disarm - disarm attachment". 
3. Finally, this email receives the CA policy "Inline - AM Inbound threat defense:containe advanced threats". This policy is supposed to quarantine the email and send a notification to the recipient saying " ...please contact the support if you are expecting this email...".
4. Here the confusion occurs: The recipient calls the support to ask for this email, however this email is defined as the spam and deleted already in the step 1. We cannot therefore release this email any more. 

Environment

SMG with CAS

Cause

CAS evaluate the message after it has been processed by the SMG

Resolution

This is the way the system is designed to work.
 
When the SMG is taking all the actions specified by the various verdicts, it has no way of knowing if (to address the specific case you mentioned) the notification is that the message is in the quarantine, or if the notification is that the message has been deleted.  For actions that are obviously over-ridden by the 'delete' action (such as 'Disarm'), those actions will not be performed.
 
The expectation is that the administrator, in constructing the policies and policy actions, takes into account the different policies and actions that they have configured and plan accordingly.
 
In this specific case it would be expected the admin to add an action to the spam policy of 'Bypass Threat Defense scanning'.  By doing so, the SMG will not spend CPU cycles testing for a verdict that will not affect the message anyway, given that the message is being deleted (due to the 'Spam' policy action)."