Content Filter - attachment-protected - Does not Drop PDF Files

[Anselmo Ferreira]

I created a policy with content filter below with dictionary that has the one domains list, if one sender from these domain send an e-mail with attachament with protected file, this action is "Drop". This rule is working on, but only password protected PDF files only
are not dropped.

Rule:
Attachment_Protection_Log_Entry-Drop: if (mail-from-dictionary-match("D-Dominios_Anexo_Senha", 1)) AND (attachment-protected)
{ log-entry("Matched_Encrypted From: $EnvelopeFrom To: $EnvelopeRecipients File: $Filenames"); drop(); }

Can someone help me?

regards

[Libin Varghese]

In lab, password protected PDF get detected as expected for a sample file I used.

You may want to open a TAC case with the configuration details and sample you are testing with.

Also, please ensure the device is able to fetch updates as expected. The content scanner engine status can be checked using command contentscannerstatus.

Regards,

Libin