An email administrator is setting up a new Cisco Secure Email Gateway. The administrator wants to enable the blocking of greymail for the end user. Which feature must the administrator enable first?

File Analysis (e.g., via Cisco Threat Grid integration) focuses on analyzing malicious attachments for malware, not on greymail classification.

IP Reputation Filtering blocks email based on the sender's IP address reputation, which is distinct from classifying greymail content.

On the Cisco Secure Email Gateway (formerly ESA), Intelligent Multi-Scan (IMS) is the core engine that provides advanced threat detection, including the capability to classify and identify greymail. Enabling IMS is a prerequisite for leveraging greymail filtering features, as it uses multiple scanning technologies to categorize email types.

Anti-Virus Filtering primarily detects known malware and viruses, which is different from identifying and blocking unsolicited but non-malicious greymail.