IronPort: Content Filter - Multiple AND OR

[FP1]

Hi community,

I have a C300V device and I would like to create a new CF rule, that contains multiple OR, AND conditions. I am just wondering how one can do this? I imagine this would have to be a manual regex?

For example:

if (rcpt-to == "@gmail.com" OR rcpt-to == "@yahoo.com" OR rcpt-to == "@outlook.com") AND (attachment-filetype == "Compressed" OR attachment-filetype == "Documents") 

Hope this makes sense? Please let me know if more info is required.

Thanks in advance

[Mathew Huynh]

Hello FP1,

I would recommend using message filters for this type of setup as the filetype rule does not allow regex to separate them.

However if content filters are required due to where it stands in the pipeline, an alternative needs to be done.

Condition 1-> Envelope Recipient -> contains -> (?i)@(gmail\.com|yahoo\.com|outlook\.com)
Condition 2 -> Attachment Filename -> Contains -> (?i)\.(rar|zip|7z|doc|txt|rtf|docx|pptx|ppt|xlsx|xls)
Set the conditions to use "AND"

Then your action.

Else the message filter I would use is:
Filter_name:
if (rcpt-to =="(?i)@(gmail\\.com|yahoo\\.com|outlook\\.com)") AND ((attachment-filetype == "Compressed") OR (attachment-filetype=="Document"))
{
quarantine('Policy');
}
.

NOTE: message filters can only be added in the CLI :)
CLI > filters > new

I hope this helps! :)

Thanks,
Matthew

[FP1]

Hi Mathew

Thanks very much for your reply. We are planning to test this rule this week, and then I will report back.

Thanks very much mate :)

[Mathew Huynh]

Hello FP1,

That's awesome - let me know how it goes.

Regards,

Matthew