Trustwave Sandboxing Service setup

1. Enable TLS on the SEG server for incoming and outgoing messages, using a valid (CA signed) certificate. TLS is required to communicate with the Trustwave Sandbox service.
2. Create a new IP Group called "IP Trustwave Sandbox". Add the Trustwave Sandbox service Public IP ranges. These are the valid sources for responses from the Sandbox service.
   • For US instance:
     • Trustwave Sandbox US Range 1: 52.191.90.76/30
     • Trustwave Sandbox US Range 2: 13.91.203.24/30
   • For EU instance:
     • Trustwave Sandbox EU Range 1: 20.31.9.32/31
     • Trustwave Sandbox EU Range 2: 20.105.76.250/31
3. Create a new Quarantine folder called “Trustwave Sandbox Errors”. This will hold messages that could not be processed by the Sandbox service or caused any error in sandbox processing. 
4. (Optional) Create two new Archive folders called “Sent to Trustwave Sandbox” and “Received from Trustwave Sandbox”. These will hold copies of the messages sent to and received from the Trustwave Sandbox service. Saving these messages can be useful in case of queries about what was processed.
5. Extract the six SEG Category Scripts from TrustwaveSandboxSEGCustomerFiles.zip. Copy the Category Scripts to the Config folder of the SEG Array Manager installation. The categories will be selectable by name when you create SEG rules.
   
   Note: The policy listings below assume that default Spam and Malware folders exist. These folders are created by default in recent installations of SEG. If these folders do not exist, you must create them.

Required Policy

Two new Policy Groups are required. The first group delivers messages to the service for processing. The second group processes messages returned from the Sandbox Service. In addition, TLS rules must be changed in many cases.

Policy Group: To Trustwave Sandbox

Place this policy group after all other Content Analysis policy groups except for Archiving policy. The rule action to copy the message to a folder is optional. The “Prefilter” condition checks for message components that can be processed through the Sandbox.

• This policy group detects incoming messages that have not been sent to the Sandbox service and routes them to the service.

Rule: Send to Trustwave Sandbox 

• Note: Be sure to specify the correct routing for your configured instance.
  The copy action is optional.

1 Rule(s)

Policy Group: From Trustwave Sandbox

Place this policy group before all other Content Analysis policy groups.

• This policy group detects messages returned from the Sandbox service and quarantines messages that were flagged by the service.

6 Rule(s)

TLS Connection Properties Policy

The Sandbox service communicates over TLS. The TLS Client Certificate for this server cannot match the sending domain. You must exclude the Sandbox server from Client Certificate domain matching rules.

Add the following condition to any TLS Client Certificate domain matching rule:

Except where addressed from 'IP Trustwave Sandbox'

For example, in the default ruleset of recent MailMarshal versions, modify the rule TLS Connection Properties > Reject Non-domain matching TLS Client Certificates

The rule should appear as follows:

Where the message is addressed to or from any user 
Except where addressed from 'IP Trustwave Sandbox'
Where the TLS client certificate was presented with options: 'Domain does not match'
Refuse message and reply with 550 TLS client certificate subject does not match sender domain

• To ensure that messages returned from the Sandbox do not trigger DoS blocking, exclude the Sandbox IP addresses from DoS evaluation. Add these ranges to the exclusion list on the Advanced tab of the Attack Prevention window (in 8.X, Exclusions button on the Attack Prevention window).