Looking at the false positives, they are in fact all from "Custom Log Entry: vBa, vBa, [Content_Types].xml"  We will ask them to update the filter.  Thanks for the quick reply! Joe

We had the following filter added to our hosted appliances by Cisco support:  if ((attachment-filename =="(?i)\\.(xls|xlsx|xlt|xla|xltx|xlsm|xltm|xlam|xlsb|doc|dot|docx|dotx|dotm|docm|ppt|pot|pps|ppa|pptx|potx|ppsx|ppam|pptm|potm|ppsm|rtf)$") AND((a...