Cisco Cisco Email Security Appliance C160 Guía Del Usuario
9-87
Cisco AsyncOS 9.1 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Attachment Scanning
attachments and strips them based on the fingerprint of the file, and not just the three-letter filename
extension. Note also that you can specify a single file type (“mpeg”) or you can refer to all of the
members of the file type (“Media”):
extension. Note also that you can specify a single file type (“mpeg”) or you can refer to all of the
members of the file type (“Media”):
In the following example, the same “executable” group of attachments (
.exe
,
.dll
, and
.scr
) are
stripped from messages whose Envelope Sender is not within the domain
example.com
.
In the following example, a specific member of a file type (“wmf”) as well as a the same “executable”
group of attachments (
group of attachments (
.exe
,
.dll
, and
.scr
) are stripped from messages whose Envelope Sender is not
within the domain
example.com
.
In the following example, the “executable” pre-defined group of attachments is extended to include more
attachment names. (Note that this action will not examine the attachments’ file type.)
attachment names. (Note that this action will not examine the attachments’ file type.)
The
drop-attachments-by-name
action supports non-ASCII characters.
Note
The
drop-attachments-by-name
action matches the regular expression against the filename captured
from the MIME header. The filename captured from the MIME header may contain trailing spaces.
strip_all_exes: if (true) {
drop-attachments-by-filetype ('Executable', “Removed attachment:
$dropped_filename”);
}
strip_inbound_exes: if (mail-from != "@example\\.com$") {
drop-attachments-by-filetype ('Executable');
}
strip_inbound_exes_and_wmf: if (mail-from != "@example\\.com$") {
drop-attachments-by-filetype ('Executable');
drop-attachments-by-filetype ('x-wmf');
}
strip_all_dangerous: if (true) {
drop-attachments-by-filetype ('Executable');
drop-attachments-by-name('(?i)\\.(cmd|pif|bat)$');
}