Attachment filter

[The-Messenger]

I have quesitons on filtering attachments.

1. Where do I set the filter in the gui?

2. Is there a text file (or some other way) that I can edit to configure what file is considered to be an "Executable"

3. Can I create a file type, for example "script" and add various file types to block.?

[Andreas Mueller · Accepted solution]

Hello there,

filters are accessible on the GUI via the

GUI: Mail Policies - > Incoming Content Filters

or

GUI: Mail Policies - > Outgoing Content Filters

Note the difference, inbound is usually any mail coming from the internet via a normal ACCEPT mail flow policy, while outbound mail is considered to be via either private listeners and/or a RELAY policy. In the filter setup you can create filter conditions and actions based on either file names, mime type, or file type. The file type list has a number of predefined file types and groups (executable, image, document, etc) that you can select from, note that this is a fixed list and that you cannot add filetypes to it manually. Same for the grouping of filetypes.

Also, after creating a filter don't forget to add it to one or more of you mail policies

GUI: Mail Policies - > Incoming Mail Policies -> Content Filters

GUI: Mail Policies - > Outgoing Mail Policies -> Content Filters

Otherwise the filter won't be used.

Hope that helps,

Andreas

[The-Messenger]

Thanks!

So, maybe a feature request would be to be able to edit groups, add a new group.  Currently I want to block script files, pretty common thing.  I know I can add these individually but there are at least 15 or 20 script type suffixes.

[viahmed]

Greetings,

I believe the script files are normally executables or may be embedded within a ZIP file and both can be blocked using current executables or compressed files option under file type. Also IronPort has option to block matching a specific filename or pattern based on its fingerprint. You need to check the best suitable option based on file type, file name, extensions etc.

Cheers,

Viquar Ahmed

Customer Support Engineer Cisco IronPort