| #

## ScanMail Scan Hierarchy

Administrators can configure security risk scans in ScanMail to provide varying levels of security. Enabling the Advanced Threat Scan Engine in conjunction with Virtual Analyzer assists in discovering and preventing targeted attacks by suspected malware threats.
The following table provides an overview of the scan engine hierarchy in ScanMail.

#### Scan Engine Hierarchy

Scan Engine | Description
--- | ---
Virus Scan Engine scanning | The Virus Scan Engine provides pattern-based and heuristic scanning for traditional malware threats.
ATSE scanning | ATSE enhances the traditional malware threat protection offered by the Virus Scan Engine. ATSE performs an aggressive scan using heuristic algorithms to identify possible targeted attacks, such as document exploits. For scan configurations that enable ATSE without sending files to Virtual Analyzer, ScanMail performs the action configured for Advanced threats on any suspicious messages and files detected as an advanced threat by ATSE.
| ##### Note Some detected files may be safe. Trend Micro recommends selecting the Quarantine entire message action for suspected threats detected by ATSE. Perform an evaluation on files not sent to Virtual Analyzer to determine the actual threat of the quarantined files. If no Virtual Analyzer is registered, Trend Micro recommends selecting scan level to Low to decrease false positves and selecting the Quarantine entire message action for suspected threats detected by ATSE.
ATSE and Virtual Analyzer | After ATSE detects a suspected malware threat, ScanMail sends the message to Virtual Analyzer for further analysis. Virtual Analyzer assesses the risk level of the message in an isolated virtual environment and returns the threat rating to the ScanMail server. ScanMail then performs the action configured for Advanced threats if the security rating violates the configured security level for suspected threats. The messages configured with low level of pretection are scanned in a traditional manner to decrease false positives. The protection scope for such messages depends on the Virtual Analyzer settings; such as traffic direction, target recipient, and so on.

Related information

- About Advanced Threat Scan Engine