sporadically faulty function of the attachment name filter

[Mrskathy]

We operate a Cisco Email Security Gateway in a cluster with version 16.0.1-019.

It often happens that ordinary Office files (docx, pptx) are filtered by the attachment name filter and not delivered (the virus scanner removed an attachment containing dangerous files).

This is not the case with test emails, however, and they arrive without errors.

We were able to determine that the affected senders have one thing in common: they are listed in the unknown list by the SBRS score and send from the Office cloud.

Can anyone help us? Whitelisting the IP in the unknown list didn't help.

[Ken Stieers]

Do the test mails fail with the same attachments?
Docx/pptx are zip files... so they can contain other files that could be dangerous, and the ESA will unzip and find them..
Do you have other filters based on file type or extension that could be catching these embedded files?

[Mrskathy]

These are delivered in test emails. Packing them into an archive results in the same error.

[Ken Stieers]

Are you using the "bad" attachments in your test mails too?
Do the logs tell you what exactly they think is bad about the attachments?