Configuring Virtual Analyzer Settings Parent topic

Before configuring the Virtual Analyzer settings, select the Enable Advanced Threat Scan Engine option on the Security Risk Scan: Target screen. Advanced Threat Scan Engine performs the aggressive scanning necessary to detect advanced threats.
Important
Important
  • Virtual Analyzer settings are not configurable until an administrator enables the Advanced Threat Scan Engine.
  • Before enabling Virtual Analyzer integration, administrators must enable the Exchange replay folder.
    For details on enabling the Exchange replay folder, see Virtual Analyzer - Integration Pre-requisites.
    WARNING
    WARNING
    Disabling the Exchange replay folder after enabling the Virtual Analyzer integration may cause unexpected issues. Trend Micro recommends disabling Virtual Analyzer integration before disabling the Exchange replay folder.

Procedure

  1. Go to Virtual Analyzer.
  2. Select Submit email messages to Virtual Analyzer.
  3. Configure the Virtual Analyzer connection settings:
    • Type the IP address.
      Note
      Note
      The IP address supports IPv4 format.
    • Type the Port number.
    • Type the API key.
      Note
      Note
      Contact the Virtual Analyzer administrator to obtain the IP address, port number, and a valid API key.
  4. Select Use a proxy server to connect to Virtual Analyzer if ScanMail requires a proxy for server communication with Virtual Analyzer.
    1. Click the expand button (expand_button.jpg) to display the proxy settings.
    2. Type the server name or IP address of the proxy server and its port number.
    3. If your proxy server requires a password, type your user name and password in the fields provided.
  5. Click one of the following buttons:
    • Register: Establishes the connection to Virtual Analyzer
    • Test Connection: Verifies the connection settings to Virtual Analyzer but does not register ScanMail to the server
    Note
    Note
    To enable sending messages to Virtual Analyzer, register Virtual Analyzer before saving the connection settings.
  6. Select the traffic direction of the messages to analyze.
  7. Choose the recipients of the messages to analyze by searching and selecting AD Users/Groups/Contacts/Special Groups and adding them to the Selected Account(s) list.
  8. Select the attachment types to analyze.
    Tip
    Tip
    As application and executable files pose the greatest threats in respect to advanced threats, Trend Micro recommends only selecting to analyze these file types.
  9. Configure the Security Level settings for the messages and files that Virtual Analyzer analyzes.
    • Security level: The security level determines whether ScanMail performs an action on messages and files analyzed and rated by Virtual Analyzer. The available security level settings are: High, Medium, or Low.
      Note
      Note
      For messages and files with a rating that violates the configured security level, ScanMail performs the action configured for Advanced threats on the Security Risk Scan Actions tab (Security Risk Scan → Action). For more information, see Configuring Security Risk Scan Actions.
    • Maximum wait time for analysis ratings: Select the maximum amount of time to temporarily quarantine messages while Virtual Analyzer analyzes the risk of the message.
    • Action on unanalyzed risks: Select the action that ScanMail performs on messages for which Virtual Analyzer did not return a rating within the configured wait time.