Mail relaying to other sites is prohibited. Server accepts only email intended for this site. Mail relaying attempts are recorded and reported as incidents. Automated audit logs are maintained for at least 1 year. Auditing is configured to record full email headers.
Logfile analysis is automated and accomplished daily.
Reports of anomalous activity are sent automatically to the system administrator. Transactions analysis to detect email contacts with foreign countries is done daily and automatically. Suspicious foreign connections are reported to the local NCIS supervisory agent.