How to prevent and delete email with Cryptolocker suspected content ?

Dear people,

My Symantec Endpoint server is 12.1.6 with 2000 device license.

Few days back over the weekend, we've recevied CryptoLocker malware with a email attachment and couple of users got infected . Unfortunatly SEP client v12.1 didn't detect this malware.

I have enabled Virus Protection, Proactive Threat Protection and Network Threat Protection.

Is there special configuration in the Symantec Messaging Gateway to detect this or to delete it ?

Thanks.