Configuring Virtual Analyzer Network and Filters

Procedure

1. Go to Administration → Scanning / Analysis → Virtual Analyzer.
2. Specify Settings.

   Option	Description
   Network Connection	Note This section is available when Deep Discovery Email Inspector is using an internal Virtual Analyzer. When the internal Virtual Analyzer is set to connect to the Internet through a proxy server, reconfigure proxy settings after a configuration restore or firmware update on Deep Discovery Email Inspector. From the Network type drop-down list, select how Virtual Analyzer connects to the network. For information about network types, see Virtual Analyzer Network Types. If you select the Custom Network type, select a specific port for Virtual Analyzer traffic from the Sandbox port drop-down list and click Configure IPv4 settings to configure the network settings. If a proxy server is required for the internal Virtual Analyzer to connect to the Internet, select Use a dedicated proxy server from the drop-down list and provide the following information: Server address Port Proxy server requires authentication: If authentication is required, select this check box and type the user name and password.
   File Submission Filters	Files: Select the file types to have Virtual Analyzer perform one of the following actions: Submit only highly suspicious files Submit highly suspicious files and force analyze all selected file types To reduce the likelihood of false-positive detections, select Do not analyze files found safe by the Certified Safe Software Service. For details, see Certified Safe Software Service.
   URL Submission Filters	By default, URLs found safe are first submitted to the URL pre-filter before submitting to Virtual Analyzer. For messages with safe URLs, you can add one or more subject keywords to filter these messages for Virtual Analyzer submission. Safe URLs in matched messages are sent directly to Virtual Analyzer, bypassing the URL pre-filter. Keyword: Type a subject keyword and click Add to add the keyword to the list. To delete a keyword from the list, select an entry and click Delete. Note You can specify up to 50 keywords.
   Timeout Setting	Select how long Virtual Analyzer should wait before timing out a submitted object. By default, when the submission timeout is reached, Virtual Analyzer sends out submitted objects waiting in the queue without analysis. Timed out objects still receive risk levels from other scan engines. You can configure threat protection rules in policies to perform actions on timed out objects. For more information, see Configuring a Threat Protection Rule.

3. Click Save.