Cisco Cisco Email Security Appliance X1070 Guia De Resolução De Problemas

ESA Content Filters for Email Messages with
Multiple Attachments

Document ID: 117821

Contributed by Enrico Werner, Cisco TAC Engineer.
Jul 01, 2014

Contents

Introduction
Problem
Example Scenario
Filter Condition
Filter Action
Solution

Introduction

This document describes how the negative content filter conditions work for email messages that
contain multiple attachments on the Cisco Email Security Appliance (ESA).

Problem

You use a content filter that allows certain types of email attachments, while other types of attachments
should be marked for quarantine. When an email message arrives that has multiple attachments, one that
should be allowed and another that should be marked for quarantine, the filter identifies the entire message as
allowed.

Here is the content filter that is used:

if attachment filename != (list of attachments), then quarantine

This condition and action functions as intended if the email message has a single attachment, but it does not
function properly for messages that contain multiple, different attachments.

Example Scenario

These are the types of attachments that are allowed:

rar

•

pdf

•

jpg

•

All other attachments should be sent to quarantine, as specified by the filter condition and action.

Filter Condition

Here is the filter condition that is used:

if attachment filename != (rar|pdf|jpg)