Cisco Cisco Email Security Appliance C190 Mode D'Emploi

attachments and strips them based on the fingerprint of the file, and not just the three-letter filename 
extension. Note also that you can specify a single file type (“mpeg”) or you can refer to all of the 
members of the file type (“Media”):

In the following example, the same “executable” group of attachments (

.exe

, 

.dll

, and 

.scr

) are 

stripped from messages whose Envelope Sender is not within the domain 

example.com

. 

In the following example, a specific member of a file type (“wmf”) as well as a the same “executable” 
group of attachments (

.exe

, 

.dll

, and 

.scr

) are stripped from messages whose Envelope Sender is not 

within the domain 

example.com

.

In the following example, the “executable” pre-defined group of attachments is extended to include more 
attachment names. (Note that this action will not examine the attachments’ file type.)

The 

drop-attachments-by-name

 action supports non-ASCII characters.

The 

drop-attachments-by-name 

action matches the regular expression against the filename captured 

from the MIME header. The filename captured from the MIME header may contain trailing spaces.

strip_all_exes: if (true) {

                    drop-attachments-by-filetype ('Executable', “Removed attachment: 

$dropped_filename”);

                }

strip_inbound_exes: if (mail-from != "@example\\.com$") {

                        drop-attachments-by-filetype ('Executable');

                     } 

strip_inbound_exes_and_wmf: if (mail-from != "@example\\.com$") {

                        drop-attachments-by-filetype ('Executable');

                        drop-attachments-by-filetype ('x-wmf');

                     }

strip_all_dangerous: if (true) {

                    drop-attachments-by-filetype ('Executable');

                      drop-attachments-by-name('(?i)\\.(cmd|pif|bat)$');

                     }