Cloud Mailbox Defense Release Notes Archive
This document includes archived release notes for September 2, 2020 through June 24, 2021. Current release notes for the product now named Cisco Secure Email Cloud Mailbox are found here: https://www.cisco.com/c/en/us/td/docs/security/cloud-mailbox/release-notes/cloud-mailbox-release-notes.html
■To unify and simplify our broad portfolio, Cisco is renaming our security offerings under the Cisco Secure banner. As part of this effort, Cloud Mailbox Defense will be renamed Cisco Secure Email Cloud Mailbox in the near future. For more information, visit cisco.com/go/secure-names.
■To unify and simplify our broad portfolio, Cisco is renaming our security offerings under the Cisco Secure banner. As part of this effort, Cloud Mailbox Defense will be renamed Cisco Secure Email Cloud Mailbox in the near future. For more information, visit cisco.com/go/secure-names.
■Updates to reclassification and remediation:
–Added a Do Not Move option to the remediation choices in Audit with Enforcement mode
–Added indicator of how many messages you are reclassifying or remediating
–Added the ability to clear selected items without performing any actions
■Cosmetic updates to Settings (gear icon) > Administration > Users.
■Last 30 Days charts are added to the Insights page. These charts are based in UTC time and translated to your local browser time. A daily roll-up of the past 90 days of data can be exported as a CSV file using the Download button.
■You can now click the legend items on Insight charts to be taken to the relevant Messages page for those results.
■ Cloud Mailbox Defense FAQ is now accessible from the Help menu.
■A Reset Filters button is included in the Refine Search filter panel. Use this button to reset the filters back to their defaults.
■ Cloud Mailbox Defense FAQ is now available. This document combines content that was previously published in the Cloud Mailbox Defense User Guide with new content based on common customer support requests.
■Charts on the Insights page can be expanded so details are easier to see.
■The default number of messages on the Messages page is now set to 100.
■Retrospective verdicts are indicated in the Timeline view.
■A Business Information section is added to the Administration page. This section includes identifiers for your business, including:
■Users on the Administration page are sorted alphabetically by First Name.
■The retrospective verdicts feature is new in this release. A retrospective verdict is one that was applied to a message sometime after the message was first scanned by CMD.
A retrospective verdict in CMD is slightly different than in other Cisco Security products. Although CMD is not an inline mail processor, it does have a fixed time range for completing its initial analysis of a message. Newer content engines that have longer analysis times, such as Talos’ Deep URL Analysis, are treated as a retrospective verdict. As the verdict is delayed, so is the remediation.
–An icon showing that a message has had a retroactive verdict applied is shown in the right column of the Messages page
–You can filter by retrospective verdict in the Refine Search filter
–You can turn email notifications on or off on the Administration page
■A new Graymail chart is on the Insights page. A preview of the chart is available on the Home page. Graymail data is included in the Insights page data download.
■Updates to the Refine Search filter:
–Added ability to filter by Auto-remediation, Retrospective Verdict, or MS Allow
–Search by direction is changed from a drop-down menu to check boxes so you can select more than one direction at a time
■The Search page has been renamed Messages to better reflect its contents.
■The Messages page column headings are now static as you scroll through your messages.
■The reclassification buttons show after you select a message or messages, even if you have scrolled down the Messages page.
■Filter by last action is added to the Search page.
■You can display and remediate 10, 20, 50, or 100 messages per page.
■The Graymail verdict is available as a manual reclassification option.
■The ability to set an automatic remediation action for Graymail is available on the Policy page.
■A print button is added to the Insights page. You can print or save as PDF.
■The Malicious and Phishing chart is now a stacked bar chart.
■Role-based access control (RBAC) is introduced:
–Existing users are now super-admin users.
–There is a new read-only user type. Read-only users can use search and insight capabilities. They cannot reclassify or remediate messages, make changes to the account setup or policies, or create new users.
■The Search page filters are moved to a side panel on the Search page.
■The ability to filter by one or more verdicts is added on the Search page.
■The Graymail verdict is introduced:
–Graymail is indicated in the Verdict column on the Search page
–You can filter by Graymail using the filter panel on the Search page
–Additional features for this verdict are being developed for future releases
■An Insights page download button is introduced. An hourly roll-up of the past 90 days of data is exported as a CSV file.
■We have changed the way CMD honors Microsoft 365 allow lists. If a sender or sender domain has been added to an allow list in Microsoft 365, CMD will no longer send the attachments to ThreatGrid for analysis.
■The Reports page is replaced with a new Insights page. The graphs are redesigned and renamed for better clarity and usability.
■The color-scheme is updated throughout the app to make the different message directions clearer.
■The Search page Download button now responds as expected. It was previously freezing under certain conditions.
■Cosmetic updates to the Home and Search pages.
■The Search page date selector is now on the right side of the page.
■Removed the Trusted verdict and added the Neutral verdict. If you classified any items as Trusted, they are still available if you search for them; the filter is no longer available.
■Added the following additional sender fields to the expanded Search view for a message:
■Added verdict icons to the reclassify dialog.
■Check boxes are cleared after items are moved or reclassified.
■Reports now reflect correct data after a message is reclassified. There could be a delay of up to one hour before the changes are reflected.
■The Administration page is reorganized for better grouping of items.
■The Microsoft Message ID is now shown on the expansion view for a message and can easily be copied to your clipboard from that view. You can search for the Message ID in the main Search field on the Home page and the Search page.
■If you delete a user from the Administration page, you can now create a new user with the same user information. This previously produced an error.
This is the initial release of Cloud Mailbox Defense (CMD). CMD is an integrated cloud-native security solution for Microsoft 365 that focuses on simple deployment, easy attack remediation, superior visibility, and best-in-class efficacy from Cisco Talos. CMD addresses gaps in Microsoft 365 security by blocking advanced email threats like ransomware, BEC, phishing, spoofing, and spam by leveraging proven Cisco Email Security technologies. For more information, see https://www.cisco.com/c/en/us/products/security/cloud-mailbox-defense/index.html
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)