Use the following information to help you understand the layout and data that appears in the reports that you generate.
Table: Report layout provides information about how reports are displayed.
Table: Report layout
Table: Report data details provides the information to help you interpret the information in reports.
Table: Report data details
Issue | Description |
---|---|
What constitutes a threat | The summary reports and the Dashboard contain threat summary graphs and tables. A threat is a harmful attribute or potentially harmful attribute of an email message. For example, threats include spam, malware, and content filtering policy violations. Similar message verdicts are grouped into threat categories. |
Single threat, multiple threat, and clean messages | The summary reports and the Dashboard categorize messages into single threat, multiple threat, and clean messages. Multiple threat messages contain more than one type of threat. For example, a message that contains spam and malware is a multiple threat message. Clean messages contain no known threats. |
Message and connection counts | The appliance uses many technologies to track email and filter email. Some of these technologies function at the email connection level before an actual email message can be generated and sent. When a connection is rejected or deferred because it triggered a bad reputation filter, that connection is counted as one message. |
Verdicts of suspect virus messages | If a message is routed to the Suspect Virus Quarantine, the outcome of rescanning the message is not counted toward total threat counts. However, the outcome of rescanning the message is displayed in the Suspect Virus Outcomes graph. The graph indicates whether quarantined suspect viruses were deleted, determined to be viruses or not, or are still in the Suspect Virus Quarantine. |
Sender HELO domain or IP connection shows gateway information | If any Scanners accept relayed messages from a gateway computer, the SMTP HELO name is the name or IP address of the gateway computer. The IP connection address is the IP address of the computer that is connected to the gateway computer. Affected reports are as follows:
The process to determine which IP address Symantec Messaging Gateway uses is as follows:
|
Processed message count | For the reports that list the number of processed messages, the number of processed messages is counted per message, not per recipient. For example, if a single message lists 12 recipients, the processed message count increases by 1, not 12. |
How duplicate verdicts per messages are reported | Each email message can have multiple recipients and multiple threats. Different recipients in the same email message may have different threats triggered. This situation occurs because the different recipients may belong to different policy groups. For example, recipients in group A may have content filtering enabled for employee data protection terms, while recipients in group B may not. Some verdicts have names associated with them to describe unique instances of that verdict type. For example, a known virus may be called W32.Zoltan or VBS.Throckmorton. Each named verdict is counted separately. If both W32.Zoltan and VBS.Throckmorton are found one or more times in a message, the malware count increases by two. The message is considered a multiple threat message. Verdicts that are not included in this list are counted once per message regardless of the number of occurrences of the verdict in the message. For example, a single message is sent to three recipients. The message to recipient A has two matches for encrypted content. The same message that is sent to recipient B has two matches for encrypted content. That same message that is sent to recipient C has no matches. The total count of encrypted content for the message is one. The malware threat count for the message is one (encrypted content counts as a malware without a unique name). If no other threats are detected in the message, it is considered a single threat message. |
See Creating and configuring reports.
See Report types.