LibraCyber offers an option to setup Anti-Spam Rule Filter that will send Spam emails directly from users (Junk) folder instead of have them quarantine in ESG. If you prefer to have spam emails in users junk folder instead of ESG, follow the below steps.
- Go to spam rules in the M365 Exchange admin center (microsoft.com) and create two rules, one for (Spam Check Rule) and the other for (Bypass rule)
- Spam Check Rule: Create a rule as follows:
- Rule Name
- Set Apply this rule if: The Sender->IP address is in any of these ranges or exactly matches-> add your ESG appliance IP
- Click the plus sign (+) in Apply this rule if
- In And select The message headers-> includes any of these words
- Type X-ESG-Spam in (specify header name) and add yes in (specify words or phrases)
- In Do the following: select Modify the message properties and select set the spam confidence level(SCL)
- Set the spam confidence level to 6
- Save it
- Create another rule
- Name: Bypass spam Filtering Clean email
- Set Apply this rule if: The Sender->IP address is in any of these ranges or exactly matches-> add your ESG appliance IP
- Click the plus sign (+) in Apply this rule if
- In And select The message headers-> includes any of these words
- Type X-ESG-Spam in (specify header name) and add no in (specify words or phrases)
- In Do the following: select Modify the message properties and select set the spam confidence level(SCL)
- Select (Bypass spam Filtering)
- Save it
- Then go to your ESG appliance Admin area->Content Analysis->Anti-Spam Settings and go to (Antispam Action Settings).
- Under (Actions for Spam email) check “Store the message in the quarantine” if you would like to have a copy of the emails in ESG and check “Deliver the message as normal” this will force ESG to send the spam emails to your office 365.
- Add this header in (Actions for clean and whitelisted email) X-ESG-Spam: no
- In (Actions for spam email) and Actions for High Spam and Blacklisted email) Add this header X-ESG-Spam: yes
This way the user can access spam emails without going to the quarantine report.