We've recently installed Ironport for email successfully and transferred a lot of our old rules from our content filtering system. One of our business's requirements is that we flag any images sent / received over a certain size. This, on our old system, was a simple rule for if attachment = image, and attachment is over xx Kb then notify.
A way to do this badly would be to match a content filter on both Message size & image attached, but this will create too many false positives with documents attached & a smaller image which matched the filter.
So I'm looking for some way, if possible, to match a certain attachment type over a certain size. Is this something which regex can help with? I've tried a string which matches the attachment header but can't make that work - not sure if Ironport doesn't scan that part, either in full message plus body or attachment alone.
I've seen something on the web about the web edition which can flag on certain sizes of certain files (e.g. don't allow .zip files over 300Kb) but nothing for the email edition.
Thanks for reading
Sam
