filter attachments by name

[crawlspace_ironport]

Hi All,

I'd like my c100 Ironport appliances to filter (strip?) attachments of a certain name.

I don't want to filter by file extension (ie. vbs, scr, etc.), only by the full filenames.

I have a list of 20+ files I'd like the Ironport to lookout for, then strip and quarentine said files until an admin can review, release or delete.

I'm not seeing an easy way to accomplish this, short of creating a filter for each file...which isn't terribly efficient.

Thanks in advance.

[kluu_ironport]

Unfortunately, there isn't a way that you can say this:

if attachment-filename contains terms in dictionary....and then list those filenames in the dictionary.

action:
quarantine('Policy');

What you can do, though laborious, if put them all out:


Option 1: (for different extensions)
if attachment-filename contains "(file1.txt|file2.doc|file3.xls|file4.zip)"

action:
quarantine('Policy');


Option 2: (for same extensions)

if attachment-filename contains "(file1|file2|file3|file4).txt"

action:
quarantine('Policy');

Hi All, 

I'd like my c100 Ironport appliances to filter (strip?) attachments of a certain name. 

I don't want to filter by file extension (ie. vbs, scr, etc.), only by the full filenames. 

I have a list of 20+ files I'd like the Ironport to lookout for, then strip and quarentine said files until an admin can review, release or delete. 

I'm not seeing an easy way to accomplish this, short of creating a filter for each file...which isn't terribly efficient.

Thanks in advance.

[Mike Kwilosz]

I'm trying to do this exact thing and I'm running into some problems.  I've created the following message filter but it doesn't appear to be working.  Has anyone successfully got a message filter to work based on a dictionary file which the filter references and grabs the filename of the attachment and quarantines it?

Thanks,

Mike