We have deployed Cisco Secure Email Threat Defense in two customer environments. It is still in development as a new product. Some customer requirements, such as sending logs to a Syslog server, are limited as ETD only supports sending audit logs. Customers have requirements for other system logs as well, which should be developed from their side. Another customer request is to restrict the IPs that can log in, which cannot be done from Cisco Secure Email Threat Defense yet. Any user with login details can log in. We can restrict the IPs in Cloud Mail Gateways, but not from Cisco Secure Email Threat Defense. It would be beneficial to improve this feature. Cisco Secure Email Threat Defense can take actions, such as requesting O365 to quarantine mail. In that case, the customer requires notification to the recipient from Cisco Secure Email Threat Defense. This option would be valuable if available. The real-time threat intelligence of Cisco Secure Email Threat Defense is an AI-based classification. It took one to two months to optimize the classification, but we still experience some false positives. Reducing the learning period would be beneficial. The learning curve shows that in the beginning, there are numerous false positives. For one month, we had to reclassify the false positives manually until the system learned. Reducing the learning time would be much better. Additional features desired in the next release include IP restrictions and user logging IP restrictions, ensuring only the customer environment can log in to Cisco Secure Email Threat Defense. Logs forwarding needs improvement as currently it only has audit logs. In Cloud Mail Gateway, we can create an IPsec tunnel to forward logs. However, in Cisco Secure Email Threat Defense, there is no option, and we must do API integration to send logs. Only SIM can get logs; Syslog cannot retrieve them.
