Break up the Virus quarantine into two Encrypted & Unscannable?

[gregskigregski]

Currently Encrypted attachments and Unscannable attachments end up in the same Virus quarantine, is there a way to split them up into two separate quarantines one called Encrypted the other Unscannable for example.

[Andreas Mueller]

Hi Greg,

there is no direct way to archive this, but it is possible via content filters. Basically you need to do three things:

1. Create your quarantines for the enrypted and unscannable verdicts, for that you maybe need to reduce the size of the other system quarantines to make room for the new quarantines.

2. In the mail policy settings (inbound and/or outbound, wherever you have antivirus enabled), configure the antivirus settings to "Deliver as is" for the Encrypted and Unscannable Messages. Also, under the advanced options for both message types, add a custom header and result, i.e AVRESULT, ENCRYPTED.

3. Create two content filters matching on each of these headers, with a quarantine action where you select the specific quarantine you have created in step one.

Submit and commit.

Hope that helps,

Andreas