Glad its working.
I will also note that, with this filter, not only does it pick up on file extension names, but the attachment-filetype == "Executable" works well against someone renaming an exe to txt, or even a DOC with an executable inside it.
... View more
Try the ESA technotes:http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-tech-notes-list.html
ESA Spoofed Mail Filtering
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117796-problemsolution-esa-00.html
... View more
You can do this as a message filter or incoming content filter. This action is a content filter that will quarantine the message. This will look for any file extensions that are in a zip file, doc, and more.
Obviously you can change the action, but this is the base information.
likely_harmful_attachments_Quarantine: if (attachment-filename == "\\.(ace|apk|app|bat|cmd|com|command|cpl|csh|dll|exe|gadget|hta|inf1|ins|inx|ipa|isu|job|jse|ksh|lnk|msc|msi|msp|mst|osx|out|paf|pif|prg|ps1|reg|rgs|run|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|workflow|ws|wsf|rar|7z|7zip|cpl|js|cab|jsp|class)$") OR (attachment-filetype == "Executable") { quarantine("Bad Quarantine"); log-entry("<===>Not authorized file type! Contact Tech Support for approval! <===>"); notify ("techsupport@yourdomain", "Dangerous Attachment Quarantined", "noreply@yourdomain.com", "Dangerous Attachment"); }
... View more
Eric, I have the same type of environment. In the System Admin > LDAP 1. Create multiple LDAP domains with whichever queries you need (.accept, etc) a. Must have access to perform LDAP query. 2. Create a domain assignments ie: List1 a. List one contains domains to test against with specific .accept profile. 3. Edit the Incoming listener a. LDAP queries > Accept Query > List1 (from #2 above) 4. Recipient Access Table (RAT) a. The domains added match the domains in List1. b. Action accept c. Ensure "Bypass LDAP Accecpt Queries for this Recipient" is NOT checked. Only when the LDAP server is unreachable. Recommendations 1. Default connections is 10 simultaneous connections to each server (resources) 2. Default cache 10000 entries try 100? or 1000? Hope this helps. Let me know if you have any questions. Jared
... View more
