Logging of URL-related logs, and display of this information in Message Tracking details, is disabled by default. This includes the logs for the following events:
Category of any URL in the message matches the URL category filters
Reputation score of any URL in the message matches URL reputation filters Outbreak Filter rewrites any URL in the message To enable logging of these events, use the outbreakconfig command in the command-line interface (CLI).
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01110.html#con_1249
933

Outbreak Filters must first be configured under Security Services so the appliance can apply outbreak filtering. Alerts are then enabled in the Outbreak Filters Global Settings, which controls alert generation for outbreak filter events.

Adding the sender to the safelist ensures legitimate messages from that address bypass spam quarantine handling in Cisco Secure Email.

In the example the SSL checkbox is not marked yet, and it shows that the ESA is able to telnet on port 443 so port must be open.

Directory Harvest Prevention. You can configure the appliance to combat directory harvest attacks using your LDAP directories. You can configure directory harvest prevention during the SMTP conversation or within the work queue. If the recipient is not found in the LDAP directory, you can configure the system to perform a delayed bounce or drop the message entirely.
Consequently, spammers are not able to differentiate between valid and invalid email addresses.
See Using LDAP For Directory Harvest Attack Prevention.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011010.html?bookSea rch=true