Email pages
The Email pages provide information about the attachments and URLs detected in email messages sent and received in the network. By default, the Detections page is displayed when you select Email from the Main navigation menu.
Use the left sidebar menu to select the email pages:
Click the icon to collapse the left sidebar menu to just display the icons. Click the icon to expand the menu.
These pages provide a high-level view of the numbers of files of different types that have been received. They also allow you to drill down into the details of individual mail attachments and to view the VMware NSX Network Detection and Response analysis report for the files that were sent to particular users.
Email setup
To enable email processing, the Sensor must be configured to access the messages correctly.
Not all email attachments are uploaded for in-depth analysis. The Sensor performs local scans, and uses advanced heuristics to identify potentially malicious attachments. Only attachments that are considered potentially malicious are uploaded and analyzed. For example, for PDF documents, embedded JavaScript is analyzed for signs of maliciousness. If there is an embedded executable in an email, this is usually a high-risk situation, so these executables are also uploaded.