The Mail Policies menu is where almost all of the controls related to email filtering happens. All the security and content filtering policies are set here, so it's likely that, as an ESA administrator, the pages on this menu are where you are likely to spend most of your time.

Installing the Cisco Umbrella root CA onto the user's device is the action that accomplishes the goal of inspecting traffic without alerting end-users. This is because the root CA allows the user's device to trust the certificates issued by the Cisco Umbrella intelligent proxy, which acts as a man-in-the-middle for SSL sites on Umbrella's grey list. Without the root CA, the user's browser would raise errors when accessing those sites, as it would detect an untrusted certificate. By installing the root CA, the user's browser would accept the certificate and allow the traffic to be proxied and inspected by the intelligent proxy. References:
* Enable SSL Decryption - Umbrella User Guide
* SSL Decryption in the Intelligent Proxy - Cisco Umbrella
* Cisco Umbrella Intelligent Proxy and SSL Decryption
* Intelligent Proxy and SSL Decryption with Cisco Umbrella

ExplanationThe command "snmp-server user user-name group-name [remote ip-address [udp-port port]] {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password]} [access access-list]" adds a new user (in this case "andy") to an SNMPv3 group (in this case group name "myv3") and configures a password for the user.In the "snmp-server host" command, we need to:+ Specify the SNMP version with key word "version {1 | 2 |
3}"+ Specify the username ("andy"), not group name ("myv3").Note: In "snmp-server host inside ..." command, "inside" is the interface name of the ASA interface through which the NMS (located at
10.255.254.1) can be reached.

Explanation/Reference: