Email Security. Content Filter scanning attachment

[samuelsancho]

Hi, is there any document where we could see in which type of files can Email Security appliance look for a string?. I would like to create an Outgoing content filter that looks "inside" the attach for a string. I think that you can do this in PDF and office documents but I'm not completely sure and also I don't know in which other file types you can look for.

The final step should be look for a string,"Confidential" for instance, and if the mail is not encrypted drop it. If there is "confidential", string the email must be encrypted, and this word could be inside Word document.

¿Is it possible?

Thank you in advance

Samuel

[Tom Foucha · Accepted solution]

There are almost 400+ file types that ESA can recognize and scan. It is possible to find those strings in PDF and Office documents as you asked among others. 

Once you find the string you can take a number of actions like Quarantine, Encrypt, Drop, etc. If you want more analysis consider using the RSA Data Loss Prevention integration on the ESA to get more accurate detection.

[samuelsancho]

Thanks for your help Tommy.

[ed.sherratt]

Hi Tommy,

Is there a list of the 400+ types? we've recently seen a DLP detection on an excel file, as planned, but a detection failure for the same data in a MS access table.

I'm not sure if this is down to the newer access file type of ACCDB rather than the old MDB

Thanks ,

Ed

[Robert Sherwin]

Should be as attached...

-Robert

[ed.sherratt]

Thank you Robert,

That fits with what I'm seeing,

I've also  found out that ACCDB support was raised as a feature request, but it's been postponed.CSCzv08956, so there's no target delivery date.

Regards,
Ed

[Robert Sherwin]

No worries.  I'm seeing a few hits against that ENH request.  But - yep, that one is there.  We can assist to drive the ENH out of postponed with further customer sightings and requests!

-Robert