The SMTP proxy can record the subject for emails scanned by an Email Outbound Real-time Protection policy. The subject line of an email can be an important parameter when investigating an incident. The subject will be available for viewing and searching in the events, alerts and incidents pages. Administrators can control when the subject should be recorded and if there are any exceptions like email addresses that can be excluded. Up to 1000 characters of the subject will be recorded and non-ASCII (UTF-8) characters are supported.
Configuration
To enable this functionality:
-
In the Netskope UI, go to Settings > Security Cloud Platform > SMTP.
-
Under Record Subject Line, click Edit.
-
Click the checkbox to set Record Subject Line enabled.
-
Optionally, choose a User Constraint Profile. User Constraint Profiles will only be applied to the sender of the email, and not the recipient. You can create a profile in the User Constraint Profile page.
-
Click Save.
Constraints
Consider the following two scenarios. You can either have the feature enabled for only the users in the User Constraint Profile or everyone except the users except the users in the User Constraint Profile.
Logs
The subject line is available for viewing and searching in the application events and incidents pages under Skope IT.
Incidents are available under the Incidents section.
Application Events
- In the Netskope UI, go to Skope IT > Events and Alerts > Application Events.
- Click + Add Filter, and select Subject Line.
From here, you can directly filter the search on the Subject Line by clicking any of the text within the Subject Line column.
Alerts
- In the Netskope UI, go to Skope IT > Events and Alerts > Alerts.
- Click + Add Filter, and select Subject Line.
From here, you can directly filter the search on the Subject Line by clicking any of the text within the Subject Line column.
Incidents
- In the Netskope UI, go to Incidents > DLP.
- Click + Add Filter, and select Subject Line.
From here, you can directly filter the search on the Subject Line by clicking any of the text within the Subject Line column.