Claranet Soho - Symantec security

Spam detection settings

administrator — Thu, 12 May 2016 12:02:02 +0000

Symantec security

Troubleshooting

Detection settings

When you have navigated to the Anti-Spam homepage (Services > Anti-Spam), click on the Detection Settings tab.

The first option you can chose is if you wish to use the approved senders list which you would have set up. This can be either the IP or Domains and e-mail address only or use both of them. You can assign to use the SPF function which explains what it does next to the ticket box.

The following option allows you to choose how Symantec will deal with the spam mail and this can be by the option in the drop down box.

You have the option of using the Skeptic Heuristics which is part of Symantec which checks everything in the mail header to make sure the mail has come from the right location. You can also choose how Symantec deals with this mail.

In the Subject Line Text section, you can customise how the subject line will appear for emails tagged as spam.

If you change your settings to quarantine spam emails, the intended recipient will be sent an email informing them that an email is in quarantine along with a link to view the email.

Managing your approved and blocked senders lists

administrator — Thu, 12 May 2016 11:46:34 +0000

Symantec security

Troubleshooting

Depending on your organisation’s Email Services configuration, you may not be able to manage your own approved and blocked senders lists. In this case, you will not see the Approved Senders and Blocked Senders tabs in Spam Manager.

An approved senders list is a list of domain names or email addresses that you want to receive email from, even though these senders may otherwise be blocked by public or company block lists or other spam detection methods.

A blocked senders list is a list of domain names or email addresses that you want to block emails from, if such mail does not typically get intercepted as spam by the Anti-Spam service scanners.

Your organisation may have company approved and blocked senders lists set up. If you are able to manage your own lists, the Email Services Administrator will have specified whether the company lists override your personal lists or vice versa.

If you have any concerns about unwanted email getting through to you or wanted email not getting through to you, contact your Email Services Administrator.

Entries on the approved and blocked senders lists can be either full email addresses or domains, for example, jsmith@domain.com or domain.com.

The maximum number of entries in your personal approved and blocked senders lists is 150 in each.

Please note, you should not put your domain name in your own approved senders list—this could cause problems with spam from spoofed email addresses not being quarantined as expected.

Viewing your approved and blocked senders

• Click the Approved Senders or Blocked Senders tab, as required.

The existing entries on your list are displayed, including the sender or domain name, whether the entry is a full email address or a domain, the entry description and the date the entry was added.

You can sort the list by clicking on the column heading and change the number of items displayed on a single page by using the Entries per page drop-down list.

You can locate an entry by:

o Searching for a specific sender.

Please note, you can use partial matching—you do not have to enter the complete email address or domain. You cannot use wildcards in this search field. Entering a * will only find emails that contain the * symbol itself in the sender field.

o Searching for senders added to the approved or blocked senders list between two dates.

o Scrolling through the pages of the list.

To view all entries again after a search click the Clear Search button.

Adding an approved or blocked sender

Entries on your personal approved and blocked senders lists can be added in a number of ways:

• You can add entries to your approved and blocked senders lists manually in the Approved Senders and Blocked Senders tabs

• When you release a spam message to your inbox, you can approve the sender of the spam message at that time. You can also approve the sender’s domain, so that any emails sent from the domain will bypass the Anti-Spam service

• Your Spam Manager Quarantine Administrator can add, edit, and delete entries on your behalf

To add an approved or blocked sender:

1. Click the Approved Senders or Blocked Senders tab, as required.

2. Click the Add Entry button.

The Add Sender page is displayed.

3. Enter the email address or domain name of the sender to add to the list. An email address must be the full address with a valid domain name, such as broberts@shopping.com. Partial email addresses, such as broberts@shopping, are not valid.

A domain name can be a full name, such as example.com, or a top-level domain, such as .com or .uk. Subdomains, such as name.domain.com, are also valid. Partial domains without the top-level domain, for example, messagelabs or webcam, are not valid. The * wildcard is also not valid within a domain name.

4. Enter a description for the entry (this is mandatory).

5. Click Save.

The new entry is displayed in the list.

To add an approved sender when you release a message from Spam Manager:

1. When you receive a message identified as spam from a sender that you wish to add to your personal approved senders list, select the message and click the Release button.

2. In the Message released confirmation, click the Approve sender or Approve domain button, as required.

The Add Entry page is displayed with the Sender box already filled in.

1. Enter a description for the entry (mandatory).

2. Click Save. The new entry is displayed in the list.

Editing an approved or blocked sender

1. Click the Approved Senders or Blocked Senders tab, as appropriate.

2. Locate the entry of interest and click on edit at the far right of the row.

3. Edit the email address or domain name, if required. An email address must be the full address with a valid domain name, such as broberts@shopping.com. Partial email addresses, such as broberts@shopping, are not valid. A domain name can be a full name, such as example.com, or a top-level domain, such as .com or .uk. Subdomains, such as name.domain.com, are also valid. Partial domains without the top-level domain, for example, messagelabs or webcam, are not valid. The * wildcard is also not valid within a domain name.

4. Edit the description for the entry (this is mandatory).

5. Click Save.

Deleting approved or blocked senders

You are not asked to confirm deletion when deleting entries from the approved and blocked senders lists.

To delete selected approved or blocked senders:

• Click the Approved Senders or Blocked Senders tab, as appropriate.

• Locate the entries of interest and select the checkboxes to the left of the entries.

• Click the Delete button.

To delete all approved or blocked senders

• Click the Approved Senders or Blocked Senders tab, as appropriate.

• Select the checkbox in the heading of the left column. All entries are selected.

• Click the Delete button.

Managing your messages

administrator — Thu, 12 May 2016 10:30:33 +0000

Symantec security

Troubleshooting

Viewing messages in Spam Manager

Once you have logged into Spam Manager, any spam email which you have is listed. Details of the sender and date are shown for each message. Depending on your organisation’s security policy, the subject of the message may also be shown.

If your Spam Manager account contains spam from more than one email address; that is, if you have set up an alias, the address to which each message was sent is shown in a Recipient column.

To sort the list:

1. Click the Summary tab.

2. Click the heading of the column to sort by.

An arrow is displayed in the column heading to indicate the direction of the sort.

To define the number of entries displayed on a page:

1. Click the Summary tab

2. Click the arrow next to the Messages per page drop-down list, and select the required number of entries to display.

Searching for a message

You can search Spam Manager for a message from a specific sender or with a specific subject.

To search for a message:

1. Click the Summary tab.

2. Type a keyword (or part of one) to identify the subject line or sender of the email in the search box.

You cannot use wildcards in the search field. For example, if you search for *, you will only find emails that contain the * symbol in the subject line or sender’s name.

3. Click the Search button.

Any messages containing the keyword are displayed.

To list all messages:

1. Click the Summary tab.

2. Click the Clear Search button.

All of your messages are listed according to your setting for the number of messages per page.

Selecting messages

When you want to delete or release your messages, you can select them either individually or one page at a time.

To select an individual message:

1. Click the Summary tab.

2. Locate the message and select the checkbox to the left of it.

To select messages a page at a time:

1. Click the Summary tab

2. Select the checkbox at the top of the list, to the left of the Sender column

All of the messages on the page are selected.

To view the content of a message:

Depending on your organisation’s security policy, you may be able to view the text content of the emails displayed in Spam Manager. To do this:

• Click the Summary tab.

• Locate the message to view and click on its sender’s name. The message is displayed.

You can check the content of the message and decide whether to release it, delete it, or neither.

If your organisation’s security policy prevents you from viewing the subject or content of email messages in Spam Manager, the only way to be able to read those messages is by releasing them to your email inbox.

You are advised to exercise caution when considering releasing messages with potentially inappropriate content, as once you have released them and received them in your inbox, they become your responsibility.

Releasing messages

When you release a message, it is sent to your email inbox. It remains visible in Spam Manager and can be identified by the small arrow icon next to the subject. Messages can be released individually or a page at a time.

If you are the owner of an account with aliases or an account group and release an email for one of your aliases or member accounts, the email is released to the original recipient’s inbox rather than to your inbox.

To release a message from Spam Manager:

1. Click the Summary tab.

2. Either:

• Select the checkbox to the left of the email to release and click the Release button at the top or bottom of the list.

• Open the email to release by clicking the sender detail, and click the Release button at the top or bottom of the message.

A Message released confirmation message is displayed. You may be able to request that the sender is added to your organisations or your own approved senders list.

To release multiple messages from Spam Manager:

1. Click the Summary tab

2. Select the checkboxes to the left of the emails to release and click the Release button at the top or bottom of the list. A Message released confirmation message for the first selected message is displayed.

3. Click the Continue button.

The next Message released confirmation message is displayed. Continue in this way until all of the messages are released.

At each Message released confirmation message, you may be able to request that the sender is added to your organisation’s or your own approved senders list.

To release a message from an active summary notification:

If your organisation has set up active summary notifications, your summary notifications contain links to release the spam emails without continual logging in to Spam Manager.

You can only release an email, once from an active summary notification due to security reasons. It prevents a malicious user from releasing an email multiple times, thereby performing a denial of service (DOS) attack. If you need to release the email again, you can do so from Spam Manager. Or ask your Quarantine Administrator to release it for you.

• From your spam notification email, click the link next to the email you wish to release. The release of the email will be confirmed.

An email cannot be released in the following circumstances:

• The email has already been released via Spam Manager

• The email has already been deleted from Spam Manager, by yourself or a Quarantine Administrator

• The email has expired. Spam emails are saved for 14 days.

Deleting messages

When you delete a message, it is removed from Spam Manager. Selected messages can be deleted individually, a page at a time, or all at once.

To delete a message:

1. Click the Summary tab.

2. Either:

o Select the checkbox to the left of the email to delete and click the Delete button at the top or bottom of the list.

o Open the email to delete by clicking the sender detail, and click the Delete button at the top or bottom of the message.

To delete a page of messages:

1. Click the Summary tab.

2. Select the checkbox to the left of the sender heading. All of the messages on the page are selected.

3. Click the Delete button at the top or bottom of the list.

To delete all messages:

1. Click the Summary tab.

2. Click the Delete All button at the top or bottom of the list.

Configuring Antivirus alert notifications

administrator — Wed, 11 May 2016 15:55:09 +0000

Symantec security

Troubleshooting

When mail is detected by the antivirus system, an alert mail can be sent to both the recipient and the administrator of the domain.

By default, all admin addresses will be configured to be the same as the main portal administrators email address. However, there may be a need for specific users of each domain to be notified if mail release is required.

1) To change the administrator address for antivirus detection, navigate to the Antivirus section of the portal.

Then select the domain which requires modification from the drop down list, or if this is for all domains select the global option.

2) Confirm that the domain is set to use custom virus settings (if this domain requires an alternate admin email address from the global settings).

3) Enter the new administrator email address into the provided field.

4) If you wish for the intended recipient of the email to be notified when a virus is detected, select yes under User Alerts.

5) Check that the mail limits are configured as required for this domain and then select, save and exit.

Anti-Virus and Anti-Spyware setup guide

administrator — Wed, 11 May 2016 15:23:46 +0000

Symantec security

Setup

Checking Symantec IP’s

Set the firewall rules using the IP's given by Symantec. Next, test the firewall rules using Pings and a Telent Session.

Please note, if you are unable to bring up a command window and perform a ping or Telenet session, visit Microsoft to search for instructions on how to fix this.

Click here to view the tutorial

Checking the network address - What's my IP?

If the external IP of your network is not registered with the service, the service will reject any traffic from that IP source. We can show you how to check your external IP by using www.whatismyip.com if necessary.

Click here to view the tutorial

Setting the proxy in your browser to point directly to Symantec

The proxy settings of a test machine will be configured so that the web traffic from the machine is forwarded to the Symantec Infrastructure to be processed. The reason for performing the implementation on a test machine is to ensure that the rest of the machines on the network will not be affected.

Click here to view the tutorial

Testing the Antivirus and Antispyware services

This test is to check the AntiVirus and Anti-Spyware services you have bought which is part of the URL filtering. This will involve downloading a HTTP Anti-Malware test file. It is specifically for testing purposes. However, if for some reason the services fail to pick up the virus, then the file can be easily removed using standard network Anti-Virus software.

You do not have to perform this test if you do not wish to, Claranet SOHO is not responsible for any situation that might occur if you are unable to remove this file.

Click here to view the tutorial

How to configure Web Filtering

administrator — Wed, 11 May 2016 14:57:22 +0000

Symantec security

Setup

URL Filtering

If you want to check over your web filtering rules you can do this all through the Symantec Portal. Under the services tab, select the option for Web Security and URL filtering.

If you are unsure of what sort of category a website will be classed as (for example social media or news websites), use URL categorisation which will tell you exactly what the Symantec portal categorises that website as.

When you are in the URL filtering section, you can see the different rules which have been created and you can create, edit and delete all rules from here. One thing to make sure of if a rule doesn’t seem to be working is in the far right column is that the rule is “Active” not “Inactive”, otherwise the rule will do nothing.

Reporting

From the reports section at the top, you are able to view what has been logged from the rules you have in place. For example, say a rule is set to block and log, if someone tries to access this website they won’t be allowed access but their attempt to access this website will be logged in the reporting section for any admin users to view.

Web Routes

The Web routes section will show you IP addresses of the routes which have been registered with Symantec and will be filtered. If you wish, you can purchase additional web routes here and view any change from the change log section.

Roaming

Within the Roaming section you can find your list of users which are enabled from the remote connect using the proxy server service. You can also enable and disable the remote connect option from here.

HTTPS Inspection

This section will scan any of the website that is using the filtering services and checks SSL encrypted traffic for anything that may be considered harmful. This will work in conjunction with your URL filtering rules as well.

You can set this to ignore particular SSL encrypted web traffic for websites or IP addresses from this screen by adding it into the table. You can also allow access to sites which have been getting certification errors which otherwise would have been blocked. This will NOT warn the end user if they go to a website which has been flagged with a certification failure.

Logging into Spam Manager

administrator — Wed, 11 May 2016 13:52:36 +0000

Symantec security

Setup

To log in to Spam Manager:

1. Click the URL in your welcome message or go to: https://clients.messagelabs.com/Administration/User-Manager/UserManageme....

2. The Spam Manager login page is displayed.

3. Enter your email address and password.

4. Click the Login button.

Depending on your organisation’s security policy, you may be prompted to change your password regularly. Your organisation may have specified restrictions on the type of password you are allowed to use.

5. The Spam Manager Summary page is displayed:

Up to four tabs are displayed:

o Summary: lists all spam redirected away from your inbox to your Spam Manager account

o Approved Senders: displays your personal approved senders list (see, Managing your approved and blocked senders lists)

Depending on your organisation’s Email Services configuration, you may not be able to manage your own approved senders list. In this case, you will not see the Approved Senders tab in Spam Manager.

o Blocked Senders: displays your personal blocked senders list.

Depending on your organisation’s Email Services configuration, you may not be able to manage your own blocked senders list. In this case, you will not see the Blocked Senders tab in Spam Manager.

o Options: enables you to change the frequency of email notifications, add aliases, and change your password.

Your Account in Spam Manager

There are several ways to access emails that are detected as spam, depending on how your organisation’s Spam Manager Quarantine Administrator has set the service up.

• Your Spam Manager account is set up by the Quarantine Administrator.

You receive a welcome message that contains a link to log in to Spam Manager.

You can log in to Spam Manager to review and/or release the emails detected as spam. You will receive notifications when you are sent spam. The notification facility may be disabled by your Quarantine Administrator. You will need to log in to Spam Manager to review and/or release emails.

• Your Spam Manager account is set up automatically when you receive your first email detected as spam.

You receive a welcome message when spam is first received for you. It contains a link to log in to Spam Manager. You can log in to Spam Manager to review and/or release the emails detected as spam.

You receive notifications when you are sent spam. The notification facility may be disabled by your Quarantine Administrator. You will need to log in to Spam Manager to review and/or release emails.

• Your Spam Manager account is set up by the Quarantine Administrator.

You will receive a welcome message which contains a link to log in to Spam Manager.

You receive summary notifications when you are sent spam. The notification contains a link to log in to Spam Manager to review and/or release the emails detected as spam. You can log in to Spam Manager to review and/or release the emails detected as spam, if desired.

• Your Spam Manager account is set up automatically when you receive your first email detected as spam.

You receive active summary notifications when you are sent an email detected as spam. You can release an email directly from the notification. The notification contains a link to log in to Spam Manager to review and/or release the emails detected as spam.