Mail Flow Policies
These are the policies that apply to the Sender Groups of the ESA, on the basis of which email traffic modulation is done.
Mail Flow Policies always applies to traffic which is Incoming to the ESA irrespective of the email being an Inbound or Outbound one.
The Mail Flow Policies works in the backend with regards to the selected Connection Behavior for that policy. The different Connection Behavior available in ESAs are:
- Accept
- Reject
- Relay
- TCP Refuse
- Continue
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/216842-understand-parameters-related-to-mail-fl.html

Before a custom quarantine that is being used can be deleted, it must be removed from the message action of any filter that is using it on Cisco ESA. Otherwise, an error message will appear stating that the quarantine cannot be deleted because it is in use.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/ b_ESA_Admin_Guide_12_0_chapter_011111.html

Default HAT Entries
By default, the HAT is defined to take different actions depending on the listener type:
Public listeners. The HAT is set to accept email from all hosts.
Private listeners. The HAT is set up to relay email from the host(s) you specify, and reject all other hosts.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0110.html?bookSearc h=true

The exhibit shows that File Analysis is enabled and Microsoft Documents are selected for analysis. When an unknown Microsoft Word document is received, the file is sent to the cloud for file analysis by the Cisco Secure Email Gateway.