Include the attachment filename in the notification email in Cisco ESA

[Prab]

Hi all,

We have a Cisco C170 ESA appliance onsite. I have a content filter that will detect if the attachment type is '.xyz'

The filter works fine. I have an action to add a new header to include the filename of the attachment. So I am using $filenames action variable. (Please see the image attached)

I have an other action to notify the recipient and  the final action is to quarantine the message.

The recipient receives the notification when the email with an attachment of type .xyz is captured by the ESA. The problem is that the header with the attachment's filename is not being seen in the notification email!

(For the workaround I have added the attachment's filenames in the subject of the notification email!)

Could someone please explain what could be the reason?

Thanks & regards,

Prab

[Mathew Huynh · Accepted solution]

Hello Prab,

The notification email will not contain the "Add Headers" rule in the content filter as the "Add Header" will apply to the original email.

Notification emails will be based only on the notification template and will not pass the work queue for any of the extra additions which you may be seeking.

The only other availability is to edit your notification template and add the details to the actual message body text through the template editor.

Regards,
Matthew