How to configure the Safe Print content filter for all macro files

[BVR EDV]

Hi,

we tried to configure the SafePrint Filter.
But we noticed that some other files that also contains Macros(Excel ...) can paass through this filter.
How do we have to configure the filter so that no macro files get through?

All attachments containing macros that can not be safe print should be strip or removed.

Thanks for all suggestions.

[ppreenja]

Hi,

Have you selected 'Safe Print Matching Attachments' or 'Safe print all attachments' option in action? Also, could you please confirm the exact conditions used?

Could you please share more details on the filter that you created?

Currently, we don't have any option to take action on multiple attachments of the same type in an email separately.

Cheers,
Pratham

[BVR EDV]

Excel macro files are not blocked or safe printed.

[BVR EDV · Accepted solution]

In order to catch all files, I probably have to add another content filter (Strip Attachment With Macro) after the SafePrint Filter.

[ppreenja]

Hi,

However, I believe that using the strip attachment in another content filter will strip the safe printed document as well but I need to test it in my lab environment to confirm it.

Cheers,
Pratham

[Ramanjaneya Devi Madem]

Currently, ESA doesn't support the safe print of Excel file types. This is the limitation.

Thanks,

Rama 

[ppreenja]

Hello,

Just to add to the same you can go through the documentation for safeprint as below: 
https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-0/user_guide/b_ESA_Admin_Guide_13-0/b_ESA_Admin_Guide_13-0_chapter_0110010.html

To check on file types supported, you can go to Scan Behavior > Safe Print Settings page on your ESA appliance.

Cheers,
Pratham

[cryptochrome]

What's the ETA for Excel support? Safe Print is useless if there is no Excel support (Excel is the number 1 distribution method for macro based malware, such as Emotet). 

Thanks