We have the same issue with graphics in conjunction with the Image Analysis feature; you don't want to have to manually forward every mail with dubious images, or even every mail quarantined for that reason that a recipient comes looking for.
Firstly, discount the easy options. #1, is video content (or even video regardless of content) an issue for your organisation? I presume it must be or you wouldn't have the rule in the first place but it's worth asking if that's actually the case. Perhaps your reseller had a standard configuration beyond the default one. If the rule isn't needed, get rid of it. #2, is video everappropriate for your organisation? If you're looking at one vaguely appropriate use for every thousand joke / trivia / spam mails with video, simply reject or drop anything with video in it. We do:
Multimedia: if (attachment-filetype == "Media") OR (attachment-filename == "(?i)\\.(3gs|3gp|au|m1v|mkv|mp4|pps|ppsx|qt|qtm|ra|rm|voc|wm|wma|wmv)$") { quarantine ("Recycle Bin"); notify ("$EnvelopeSender", "Cannot accept rich content", "", "Reject-multimedia"); }
Yes, I had to go and create a quarantine area called Recycle Bin. It just seemed... fitting. Reject-Multimedia is a Notification Template text resource that tells the sender their attachments are incompatible with our workstations, and to contact their recipient without the attachments if they think their material can be read. We've found that this weeds out 100% of all time-wasters, though yours may be more obstreperous.
If the easy options are out, you do need to check video after all before delivering the mail. Aside from the formats you named, how about all the others listed in the policy above? The postmaster's workstation needs support for all of the types you plan to admit plus discreet audio in case the images are innocious but the soundtrack is not.
We resolve our image control issue with the following rule. This leaves a copy in a quarantine called Graphics and diverts the original to a mailbox created specifically to view suspect mail. This combines the most efficient way for a team to handle the mailbox (if you check a mail, you delete it from the mailbox and delete or release it from quarantine) with the least overt intrusion into the delivery process and it also means I don't have to bump all of my colleagues up to Administrator to manually forward the odd mail. You would need to combine the conditions from the above rule with the actions below in order to obtain a similar rule for selected video types.
IA-Inappropriate: if (image-verdict == "inappropriate") { insert-header("IronPort-Image-Analysis", "Inappropriate"); duplicate-quarantine ("Graphics"); alt-rcpt-to (postmaster_image_mailbox_address); }
Administrators of much larger boxes will be shaking their heads at this, as the volumes would rapidly exceed the ability of any service desk to keep pace with the flow. There are several variations I've considered but not yet implemented, for example to forward a notification on to the recipient with enough information for them to guess if the mail is worthwhile and come looking for it if it is. However, that would be trading our time for theirs so at this time it's just an idea.
examples from C150 running 6.5.3-007; I really must upgrade
