One of the things that I absolutely
love about the email security appliance
is its integration with TALOS in the cloud, with its security
services and intelligence, including the IP and Domain
Reputation Center.
Let me show you.
So I just did a Google search, and went
to TALOSIntelligence.com/repuation
center, and this is the brains behind letting our email
security plans know that, hey, that email that just came
in from this MTA, this email server,
here's the reputation for it based on everything we know. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here's the reputation for it based on everything we know.
And then the email security appliance can say, yep,
I'm going to go ahead and drop that email.
I'm not going to receive it, because it
has a bad reputation, i.e. the sender has a bad reputation.
And that's likely going to kill most of the traffic that should
be dropped right at that spot.
However, if we need to do a manual block
or add somebody to the deny lists we
don't allow inbound emails from that MTA,
we can do that as well.
Let me show you how to do that.
Here in the email security appliance interface,
we go to Mail Policies right here,
and then if we go down to HAT Overview, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then if we go down to HAT Overview,
we have these predefined sender groups.
And the way these are identified is
based on their sender-based reputation score.
That's the SBRS.
So based on the information that our email security appliance
gets from TALOS, if it comes in at a negative 6 here,
that's automatically going to be placed
on this list, which by the way, is going to be dropped.
Or if TALOS indicates it's a value of, let's say,
negative 1, right here, it would go on this list.
And so this HAT, the host access list, most
of the email servers that we're going to be dealing with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of the email servers that we're going to be dealing with
are going to have reputation scores that are dynamic
that we've learned via TALOS.
And that removes the need for us to create
a long list of servers that are trusted or not trusted.
We can base on the reputation, and then
the HAT, the host access table, will
be dynamically populated with the appropriate center
group based on their reputation. and if we
did want to add a device permanently,
we could just go to our center group, click on it,
and here it is showing us the settings.
So it's negative 10 to negative 3,
we could edit the settings if you wanted to. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could edit the settings if you wanted to.
And if we wanted to add an additional sender to that list,
we just click on Add Sender.
And then we could do it based on IP address or geolocation.
We'd put in that information, and let
me pick on somebody that's not to get mad at me.
Let's go ahead and pick on Aruba.
Sounds beautiful.
And we'll click on Submit.
And then we'll click on Commit.
And then it give us an opportunity
to add comments for our commit, and they'll take us back
to the HAT overview.
So now, based on how we just modified that sender group,
any MTAs that are sourced from Aruba WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
any MTAs that are sourced from Aruba
are going to have this mail flow policy applied to it.
So the mail flow policies are blocked, which means drop it.
Throttled, we're controlling how many emails and so forth,
or Accepted.
So if we want to modify a mail flow policy,
we could do it here by clicking on it,
or we could just go to Mail Policies,
and just go to Mail Flow Policies,
and take a look at those details as well.
So for blocked, if we click on that,
it basically says the action is to go ahead and reject it.
So again, to get to that, we went to Mail Policies, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So again, to get to that, we went to Mail Policies,
and then we went to HAT Overview.
And another place to get to the same information
would be under Network and Listeners.
Here I have a listener name called Incoming Mail, that
would be our public listener, and it also
has a link here for HAT as well, the host access table.
So we click on that, it takes us back
to that same table where we can click on the links
and modify those details once again.
In this video, we identified two basic things.
Number one, the HAT is primarily reputation scores that
is being fed to us from TALOS, but we can also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is being fed to us from TALOS, but we can also
manipulate a senders group and we
can add by geolocation or IP address or domain,
we can manually add to the senders group
and make that a permanent part of those
sender groups instead of just having
it all dynamically learned.
And anything we configure manually
is going to override whatever we received from TALOS.
So up to this point, our primary focus with email security
appliance has been inbound email,
and then in the next video, I'd like
to chat with you about outbound email
and some precautions the email security appliance
can take there as well.
So I'll see you in the next video in just a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'll see you in the next video in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.