Advanced Threat Defense email reports list attachments with a severity of "unverified" and an overall email verdict of "-3: scan timeout"

Technical Articles ID: KB92074
Last Modified: 8/27/2020

Environment

McAfee Advanced Threat Defense (ATD) 4.x
McAfee Advanced Threat Defense Email Connector

Problem

ATD email reports list attachments with a severity of unverified and an overall email verdict of -3: scan timeout.

Cause

Your sender MTA sends multiple email messages over one SMTP connection. But, it sends them without closing the connection to the ATD Email Connector between each send.

The Email Connector calculates the ATD scan timeout by comparing the delta between the current time and the SMTP connection establishment time. It does not use the delta between the current time and arrival time of an individual email message.

The sender MTA reuses an SMTP connection without sending the QUIT command. The time spent sending the previous email messages as part of this connection, is added to the timeout timer.

This time eventually exceeds your ATD scan timeout setting value.

Solution

Configure your sender MTA as below for delivering emails to the ATD Email Connector:

Maximum concurrent SMTP connections: 300
Maximum messages per one SMTP connection: 1

NOTES:

See your sender MTA vendor for how to change the settings on your sender MTA.
The ATD Email Connector performs an action when ATD is overloaded. One of its gating criteria is 300 concurrent SMTP connections. McAfee does not recommend that you configure the sender MTA to establish more than 300 concurrent connections to the ATD Email Connector. See the Email Connector section in KB79333 for more information.

Related Information

The email report records the email verdict as -3: scan timeout when ATD takes a longer time than the maximum time per email to wait for all scans to complete. This report is an indication that your ATD is near its scanning capacity. Or, the specific email has too many attachments.

If you see the email verdict as -3: scan timeout even after you configure your MTA according to the workaround provided in this article, consider taking one or more of the following actions:

Increase the number of sandbox VM licenses under VM profiles settings in ATD.
Deploy more ATD Email Connectors and balance the SMTP delivery connections across ATD nodes from your MTA.
Enable and fine-tune email filtering, such as antivirus and antispam, at your MTA. Perform this content filtering before you forward emails to the ATD Email Connector.
Enable the maximum number of attachments and size limit at your MTA. This configuration means that your MTA does not forward emails with too many attachments.

Affected Products

Advanced Threat Defense 4.8.x
Advanced Threat Defense 4.6.x (EOL)
Advanced Threat Defense 4.4.x (EOL)
Advanced Threat Defense 4.2.x
Advanced Threat Defense 4.0.x (EOL)
Best Practices
Configuration
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Advanced Threat Defense email reports list attachments with a severity of "unverified" and an overall email verdict of "-3: scan timeout"

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Advanced Threat Defense email reports list attachments with a severity of "unverified" and an overall email verdict of "-3: scan timeout"

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title