Agari - APP on Cisco ESA - To forward or not to forward

For users which also have an integration between the Cisco ESA's and Agari ATP or how Cisco calls' it Cisco APP. What should you do in such cases.

Long story short, you could forward Cisco ESA data to the Cisco APP platform by enabling the forwarding option in the mail policies to forward to Advanced Phishing Protection.

There are multiple ways on how you can integrate Agari ATP into your mailflow. The option is of choice is to forward Office 365 journaling data to the Agari sensors, where the metadata is extracted. Another way is to put the Agari appliances or sensors into your mail flow for the metadata extraction. The last option would be to ask your ESA to forward your metadata to Agari directly.

While the first two options will allow you to take action in a bidirectional way, meaning Agari ATP can directly take action on source messages, the option to just forward from ESA to Agari does not provide any added value until Cisco will have in the next 12-18 months a bi-directional integration to the ESA.

So recommendation for now, if you are an existing Agari ATP and Cisco ESA customer, don't enable this option on your ESA, unless you want to see all the data in Agari ATP 2 times.

Another email mystery solved for now....