| #

## What are different working modes in Virtual Analyzer and which one should I choose?

ScanMail provides the following two working modes of integration with Virtual Analyzer:

- Inline mode: Quarantines suspicious or specified messages, and sends to Virtual Analyzer for analysis. Messages will be delivered if no advanced threat is detected by Virtual Analyzer.
  Trend Micro recommends configuring this mode in a production environment, and configuring Attachment Types option to Highly recommendable file types.
- Monitor mode: Copies suspicious or specified messages and sends to Virtual Analyzer for analysis. Messages will be delivered immediately to the end user without any time delay.
  Trend Micro recommends configuring this mode for administrators who only need to monitor or audit advanced threats.