Blocking attachments of file type .icl

[Andreas Stenlund]

Hi

We would like to configure our IronPort server to drop attachments of type iCal (.icl). However I can not find that file type under file types in the Attachment file info File type is. Is there some way to add a custom file type in IronPort? Or will it work with adding a filename contains *.icl type of condition?

In the log it shows the attachment as a name of meeting.icl but I dont know if all the iCal meetings has that name or if that meeting simply was named that way.

[Andreas Mueller]

Hello Andreas,

easiest way would be matching to the file name with the file name  action in message or content filter (I suppose you'd not need a  condition for that, because an action drop-attachment-by-filename is  already a perfect fit, and makes the filter easier). 

In theory, there is also a message filter condition  called "attachment-binary-contains", which let's you enter a binary  pattern, i.e. a magic number for a given file type. However, this  condition has no corresponding action to drop that attachment, so it  would be only useful to quarantine or drop a whole message.

Hope that helps,

Andreas