Hello Mehdi,
The ESA's workflow when you send an email to quarantine, it will still pass through any remaining services before going into the quarantine.
For example:
Workqueue is.
Message filter -> Antispam, Antivirus, AMP, Graymail , Content Filters, Outbreak filters (Assuming you're on 9.7, you'll see AMP and Graymail).
If your email gets flagged by anti-spam as suspected spam where you set it to quarantine, it will not get quarantined immediately. Instead it will go through anti-virus, where it may or may not get dropped / altered, then AMP, graymail, content filters and outbreak filters.
From what I can tell, your email is flagged for quarantine but there is a content filter which is dropping the attachment as per your configuration.
"A MIME attachment of type <application/octet-stream> was removed here by a drop-attachments-by-name filter rule on the host ". This normally occurs due to a drop attachment content filter rule matching it.
If you want emails destined to the quarantine from Antispam or Antivirus to not get altered by content filters, on your spam and virus setting, when you set to 'quarantine' add a special header in the 'advanced' tab, then create a new content filter and order it on top.
Look for this special header added, and skip all remaining content filters.
Regards,
Matthew
