Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
- play_arrow Juniper Advanced Threat Prevention Cloud Overview
- play_arrow Juniper Advanced Threat Cloud Prevention Setup
play_arrow Juniper ATP Cloud Web Portal
- play_arrow Juniper ATP Cloud Web Portal Overview
play_arrow Enroll SRX Series Firewalls in Juniper ATP Cloud Web Portal
- play_arrow Enroll and Manage SRX Series Firewalls
play_arrow Monitor Juniper ATP Cloud Features
- play_arrow Reports
  - Reports Overview
  - Configure Report Definitions
- play_arrow Hosts
  - Hosts Overview
  - Host Details
- play_arrow Identify Infected Hosts
  - Compromised Hosts: More Information
- play_arrow Threat Sources
  - Threat Sources Overview
  - Threat Source Details
- play_arrow Identify Hosts Communicating with Command and Control Servers
  - Command and Control Servers: More Information
- play_arrow IoT Device Discovery and Classification
  - IoT Device Overview
  - Create Threat Feeds for IoT Devices
- play_arrow Reverse Shell
  - Reverse Shell Overview
- play_arrow Files
- play_arrow E-mails
  - Quarantined Emails Overview
  - Blocked Attachments Overview
- play_arrow Statistics
  - Statistics Overview
  - Statistics Details
- play_arrow DNS
- play_arrow Encrypted Traffic Insights
  - Encrypted Traffic Insights Overview and Benefits
  - Encrypted Traffic Insights Details
play_arrow Configure Juniper ATP Cloud Features
- play_arrow Allowlists and Blocklists
  - Allowlist and Blocklist Overview
  - Create Allowlists and Blocklists
- play_arrow Email Scanning: Juniper ATP Cloud
- play_arrow File Inspection Profiles
  - File Inspection Profiles Overview
  - Create File Inspection Profiles
- play_arrow Adaptive Threat Profiling
  - Adaptive Threat Profiling Overview and Configuration
  - Create an Adaptive Threat Profiling Feed
- play_arrow Feeds Configuration
- play_arrow Infected Hosts
  - Configuration for Infected Hosts
- play_arrow Threat Intelligence Sharing
  - Configure Threat Intelligence Sharing
- play_arrow Misc Configurations
play_arrow Administration
- play_arrow Juniper ATP Cloud Administration
play_arrow More Documentation
- play_arrow ATP Cloud Tech Library Page Links
  - Links to Documentation

list Table of Contents

English

keyboard_arrow_right

Emails: Configure IMAP

date_range 05-Apr-24

arrow_backward

arrow_forward

To access this page, navigate to Configure > Emails > IMAP.

Read the Emails Overview topic.
Decide how malicious emails are handled. For IMAP, the available options are to block or permit email. Unlike SMTP, there is no quarantine option for IMAP and no method for previewing a blocked email.

Select Configure > Emails > IMAP.
Based on your selections, configuration options will vary. See the tables below.

Table 1: Configure Block Malicious Messages
Setting	Guideline
Action to take	Permit download of malicious attachments—Allow email attachments, either from all IMAP servers or specific IMAP servers, through to their destination. Note: In Permit mode, black and allowlists are not checked. Emails from blocklisted addresses are not sent to the cloud for scanning. They are allowed through to the client. Block download of malicious attachments—Block email attachments, either from all IMAP servers or specific IMAP servers, from reaching their destination. Note: In Block mode, black and allowlists are checked. Emails from blocklisted addresses are blocked. Emails from allowlisted addresses are allowed through to the client. Recipients can send a request to an administrator to release the email. Enter the email address to which recipients should send a release request. Note: If a blocked email has multiple recipients, any individual recipient can request to release the email and all recipients will receive it. When you select to block email attachments, in place of the original email, intended recipients receive a custom email you configure with information on the block action. Both the original email and the attachment are stored in the cloud in an encrypted format.
IMAP Server	All IMAP Servers—The permitting or blocking of email attachments applies to all IMAP servers. Specific IMAP Server—The permitting or blocking of email attachments applies only to IMAP servers with hostnames that you add to a list. A configuration section to add the IMAP server name appears when you select this option. When you add IMAP servers to the list, it is sent to the SRX Series Firewall to filter emails sent to Juniper ATP Cloud for scanning. For emails that are sent for scanning, if the returned score is above the set policy threshold on the SRX, then the email is blocked.
IMAP Servers	Select the Specific IMAP Server option above and click the + sign to add IMAP server hostnames to the list. Note: You must use the IMAP server hostname and not the IP address.
Email Notifications for End Users
URL to learn more about Policy	If you have a corporate web site with further information for users, enter that URL here. If you leave this field blank, this option will not appear to the end user.
Subject	When an email is blocked, the recipient receives a custom message informing them of their blocked email. For this custom message, enter a subject indicating a suspicious email sent to them has been blocked, such as "Malware Detected."
Custom Message	Enter information to help email recipients understand what they should do next.
Custom Link Text	Enter custom text for the Juniper ATP Cloud quarantine portal link where recipients can preview blocked emails and take action on them.
Buttons	Click Preview to view the custom message that will be sent to a recipient when an email is blocked. Then click Save. Click Reset to clear all fields without saving. Click Save if you are satisfied with the configuration.

Administrators Who Receive Notifications

To send notifications to administrators when emails are blocked or released from quarantine:

Click the + sign to add an administrator.
Enter the administrator's email address and click OK.
Once the administrator is created, you can uncheck or check which notification types the administrator will receive.
- Block Notifications—When this check box is selected, a notification is sent when an email is blocked.
- Unblock Notifications—When this check box is selected, a notification is sent when a user releases a blocked email.

arrow_backward PREVIOUS Emails: Configure SMTP

NEXT arrow_forward File Inspection Profiles Overview

footer-navigation