Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configure IMAP Settings

 

Use the IMAP Settings page to configure email management for IMAP. With email management for IMAP, the enrolled SRX Series devices can transparently submit suspicious emails to Juniper ATP Cloud for inspection and blocking.

Before You Begin

  • Read the Juniper ATP Cloud Email Management Overview topic.

  • Decide how malicious emails are handled. For IMAP, the available options are to block or permit email. Unlike SMTP, there is no quarantine option for IMAP and there is no option to preview a blocked email.

To configure the IMAP settings:

  1. Select Configure > Threat Prevention > Feed Sources.

    The Feed Sources page appears

  2. Under the ATP Cloud tab, right-click ATP Cloud Realm or from the More list, select IMAP Settings.
  3. Complete the configuration as per the guidelines given in Table 1.

    Based on your selections, configuration options will vary.

Table 1: Configure Block Malicious Messages

Setting

Guideline

Action to take

  • Permit download of attachments—Allow email attachments, either from all IMAP servers or specific IMAP servers, through to their destination.

    Note: In Permit mode, blocklists and allowlists are not checked. Emails from blocklisted addresses are not sent to the cloud for scanning. They are allowed through to the client.

  • Block download of attachments—Block email attachments, either from all IMAP servers or specific IMAP servers, from reaching their destination.

    Note: In Block mode, blocklists and allowlists are checked. Emails from blocklisted addresses are blocked. Emails from allowlisted addresses are allowed through to the client.

    Recipients can send a request to an administrator to release the email. Enter the email address to which recipients should send a release request.

    Note: If a blocked email has multiple recipients, any individual recipient can request to release the email and all recipients will receive it.

When you select to block email attachments, in place of the original email, intended recipients receive a custom email you configure with information on the block action. Both the original email and the attachment are stored in the cloud in an encrypted format.

IMAP Server

  • All IMAP Servers—The permitting or blocking of email attachments applies to all IMAP servers.

  • Specific IMAP Server—The permitting or blocking of email attachments applies only to IMAP servers with hostnames that you add to a list. A configuration section to add the IMAP server name appears when you select this option.

When you add IMAP servers to the list, it is sent to the SRX Series device to filter emails sent to Juniper ATP Cloud for scanning. For emails that are sent for scanning, if the returned score is above the set policy threshold on the SRX, then the email is blocked.

IMAP Servers

Select the Specific IMAP Server option above and click the + sign to add IMAP server hostnames to the list.

Note: You must use the IMAP server hostname and not the IP address.

Email Notifications for End Users

Learn More Link URL

If you have a corporate web site with further information for users, enter that URL here. If you leave this field blank, this option will not appear to the end user.

Subject

When an email is blocked, the recipient receives a custom message informing them of their blocked email. For this custom message, enter a subject indicating a suspicious email sent to them has been blocked, such as "Malware Detected."

Custom Message

Enter information to help email recipients understand what they should do next.

Custom Link Text

Enter custom text for the Juniper ATP Cloud quarantine portal link where recipients can preview blocked emails and take action on them.

Click Preview to view the custom message that will be sent to a recipient when an email is blocked.

To send notifications to administrators when emails are blocked or released from quarantine:

  1. Click the + sign to add an administrator.
  2. Enter the email address of the administrator and click OK.
  3. Once the administrator is created, you can uncheck or check which notification types the administrator will receive.

    • Block Notifications—If you enable this option, a notification is sent when an email is blocked.

    • Unblock Notifications—If you enable this option, a notification is sent when a user releases a blocked email.

Related Documentation