Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
When defining an incoming mail policy and specifying recipients, there is the option for "If one or more conditions match" which translate to an OR evaluation for any recipients listed under "following recipients" as well as the option for "Only if a...
My default Mail Policies for Anti-Virus are set to quarantine attachments are unscannable, which is acceptable for 99% of the senders I receive mail from. However, I have a few vendors who will randomly send me unscannable attachments (PDF) due to d...
Is there any way to block office document types that contain macro's in this? The most recent cryptolocker variant (Locky) contains macro's which makes it more challenging to intercept. Blocking all office document attachments entirely isn't consid...
2xC170's on 7.6.1-022 in a cluste and LDAP integrated to Active Directory. All authentication is working as expected, I've seen now issues.After a user clicks "Release" on a line item in their spam quarantine notification e-mail, the e-mail is relea...
Mathew,
Wondering if you can comment in this version of the filter, which is posted in this thread elsewhere:
if (attachment-filename == "(?i)\\.(xls|xlsx|xlt|xla|xltx|xlsm|xltm|xlam|xlsb|doc|dot|docx|dotx|dotm|docm|ppt|pot|pps|ppa|pptx|potx|ppsx|ppa...
I was planning to expand it out to include the changes you and Mathias added, just hadn't gotten to re-working it use. Was quick and easy to copy/paste what support sent me back as I was just wanting to ask for general feedback on doing it this way...
When I provided your filter to IronPort Hosted support, they suggested a modified version as follows:
if (sendergroup != "RELAYLIST|SMA"){if (attachment-filename == "(?i)\\.(xls|doc|ppt|xlsx|docx|pptx)$"){if (attachment-binary-contains("(?i)vba")){if...
I am using Cisco hosted IronPort and don't currently have CLI access. It doesn't seem like I'll be able to create this content filter through GUI, is that correct?
I believe I can request CLI access via the hosted service, so I may need to do that.
