Enable ESA Monitoring with BCC

Prerequisites

Complete Before You Begin and Set Up Email Routing in xorlab

Message Filter

The first step is to create a message filter that sends a BCC copy of all incoming and outgoing emails to xorlab. The following snippet shows such a message filter, assuming the ESA has different receive listeners for incoming and outgoing emails:

ActiveGuardBCCEmails:
if recv-listener == "<incoming Listener>" {
    insert-header("X-Original-Envelope-From","$EnvelopeFrom");
    bcc-scan("<xorlab Security Platform Email>");
} else {
    if recv-listener == "<outgoing Listener>" {
        bcc-scan("<xorlab Security Platform Email>");
    }
}

“xorlab Security Platform Email” corresponds to any email address with a domain that resolves to the xorlab MTAs. You can set it to monitor@mx.xyz.activeguard.cloud, for example. See the DNS registration section for details on how to set and configure your DNS records. Note that this rule adds the original envelope FROM to the BCC email, which is required by xorlab. If the BCC emails should be sent through a specific network interface, add an additional content filter like this (where <NIC> corresponds to the desired network interface):

Content Filter to specify a network interface for the BCC emails

Bounce Profile

Now, we need to create a bounce profile so that no bounce or warning messages are sent to the sender if a BCC email could not be delivered to xorlab:

Bounce profile to disable bounce and warning messages This bounce profile should be applied whenever an email is sent to xorlab. To this end, add a Destination Control for the domain used above in the xorlab Security Platform email address:

Apply the new Bounce Profile only to emails sent to xorlab Security Platform

Next steps

Add Your Trusted Infrastructure

⌘I

​Message Filter

​Bounce Profile

​Next steps

Message Filter

Bounce Profile

Next steps