Views:

The current rule is as follows:

  • File Submission Quota = seat x 0.1 in 24 hours slide windows
     
    The quota will be 5 if the seat number is less than 50.
     
  • URL Submission Quota = seat x 8 in 24 hours slide windows

As an example, if the customer seat number is 1000:

  • The quota of file submitted to sandbox = 100 in 24 hours slide windows
  • The quota of URL submitted to sandbox = 8000 in 24 hours slide windows

Sample hits the local or cloud cache, or Risk Rating value of error (<0) will not cost the quota.

To know if the quota has been reached, do either of the following:

  • Check the "Virtual Analyzer Quota Usage Details" Dashboard.

    Virtual Analyzer Dashboard

    Click the image to enlarge.

  • Under Policy Events, query by Threat type "Scan Exception" and subtype "Virtual Analyzer submission quota exception".

To verify why a specific mail was not sent to the Virtual Analyzer, you can check the "Mail Tracking Details" page which should give you a clue.

Mail Tracking

Click the image to enlarge.

For file or URL submissions over quota, you can configure scan exception actions and decide how you want such mails to be handled. For details, see Configuring "Scan Exceptions" Actions.

 
Customers who have both Email Security Advanced and Cloud App Security licenses are encouraged to activate the cloud sandboxing included in both products to get double layer protection. If Email Security Advanced’s file sandbox hits the quota limit, suspicious files will be sent to the Cloud App Security sandbox for analysis.