Quarantine EXEs and Notifications

[Mike Luebbers]

We are trying to accomplish the following and wonder if anyone has ever done this before. We want to do the following:

1. Quarantine all executables that are being delivered inbound.
2. Have the original recipient (the receiver of the message with the executable was intended for) receive a quarantine notification.
3. Within the quarantine notification have the option to release the executeable

Thanks

[ravi saini]

Hi Mike,

Following message filter will work:

exe_attachment:

if (attachment-filetype == “Executable”)

{

insert-hearder("X-IronPort-Quarantine")

}

for incoming emails you can create a same content filter to insert the header in incoming mail policies

and if you have enabled spam notification ,recipient will recieve notification and he can release the email.

[Mike Luebbers]

Thanks Ravi, I will give that a try!