Exchange/ePrism quarantine settings

Question

I'm temporarily overseeing the company's infrastructure while we find a replacement for someone who recently left. We have on-premise exchange with ePrism (EdgeWave). Most of our users find our email security very inconvenient as they find themselves having to to go the ePrism portal many times during the day. The prior sysadmin set up the ePrism settings as follows:

1 - JUNK: Subject is prefixed with weird prefix and delivered.

2 - SPAM: was held in ePrism quarantine; users would need to login and release.

3- Everything else is quarantined: Virus, Phishing, Virus, etc

I decided to make the following changes:

1 - JUNK: Prefix subject with [JUNK] and deliver.

2 - SPAM: Prefix subject with [SPAM] and deliver.

3- Everything else is quarantined: Virus, Phishing, Virus, etc

4- Add exchange rule to change SCL whenever the emails were prefixed as above to level that causes it to go to the Junk folder in Outlook; (the threshold was set to 8 which seems high).

While what I did makes sense to me, I can't help to wonder if I am missing something; keep in mind that I am no sysadmin nor have any experience. I've found posts where other companies do the same as our original set up, deliver JUNK and quarantine SPAM.

Any thoughts? Am I missing something? Why would we quarantine SPAM?

Answer 1

Why would we quarantine SPAM?

When some spam messages deliver to users' mailboxes, if they visit the unknown and unsafe links in these messages, their privacy information could be disclosure, or other security problems could happen.

Any thoughts? Am I missing something?

Sorry for that I'm not familiar with ePrism, however, based on my research, for one on-prem Exchange Server, , you could create some transport rules which are specified conditions(e.g. The sender is from outside the organization, the subject or body includes some keywords) and actions(e.g. Forward the message to one or more moderators for moderation, block the message, modify the spam confidence level -- SCL etc.) to moderate spam messages.

• Transport rule on Exchange 2010:

• Transport rule on Exchange 2013 or later version:

Besides, the antispam functionality on Mailbox servers and DKIM/SPF/DMARC are also useful to stop spam or spoofing email message.