Search and Remediate Actions on Messages in the Mailboxes

Before you begin

  • Make sure that you have enabled mailbox remediation and configured the account settings on Cisco Email Security Gateway.

  • Enable Message Tracking on your appliance. See Setting Up Centralized Message Tracking.

  • If you are using the Centralized Message Tracking service, make sure that you have enabled the trailblazer port and AsyncOS API HTTP port on the managed Cisco Email Security Gateway and the Cisco Secure Email and Web Managerappliance can access the trailblazer port. If the trailblazer port is disabled, ensure that the Cisco Secure Email and Web Manager appliance can access the AsyncOS API HTTP(S) port on the managed Cisco Email Security Gateway.

  • If the managed Cisco Email Security appliance is using a certificate whose Certificate Authority does not exist in the Cisco Secure Email and Web Manager appliance trust store, the server certificate validation on the Content Security Management appliance fails. To allow communication, add the Certificate Authority of the signed certificate used by the Cisco Email Security appliance to the Cisco Secure Email and Web Manager appliance. To add the Certificate Authority, use certconfig > CERTAUTHORITY sub command in the CLI.

    CAUTION: If you want to disable the server certificate validation on the Secure Email and Web Manager appliance, use the esaapiconfig command in the CLI. Cisco does not recommend you to disable the certificate validation for security reasons.

Procedure

Step 1

On the Security Management appliance, click on the Tracking tab on the new web interface of the appliance.

Step 2

Click the Messages tab to narrow your search results. For more information, see Searching for Email Messages on the New Web Interface.

Step 3

Select the messages you want to remediate. You can select a maximum of 1000 messages at a time. You can remediate the messages that are only in the delivered state.

Step 4

Click Remediate.

Step 5

Enter the following details:

  • Enter a batch name for the remediation.

  • Select anyone of the following remediation action:

    • Delete the messages. Select this option to permanently delete the messages from the end user’s mailbox.

    • Forward to an email address. Select this option to forward the messages to a specified user, for example, an email administrator.

    • Forward to an email address and delete the messages. Select this option to forward the messages to a specified user, for example, an email administrator and permanently delete that messages from the end user’s mailbox.

Step 6

Click Apply.

After you click Apply, you can view the Remediation Report Status widget at the bottom-right corner of the Message Tracking page. Use this widget to check the status of the Remediation Report generation. After the Remediation Report generation is complete, click View Details on the widget to go to the Remediation Report to view the remediation results.

Note

You can also view Remediation Report directly by navigating to Reports > User Reports > > Remediation Report and click the Mailbox Search And Remediate tab.