Help with content Filtering

david.shoesmith · ‎04-03-2008

Hi all,
I have setup some content filters on our C300 appliance.
One of the filters checks for attachments of type media and puts the email into a quarantine area.
Another filter checks for attchments of type image and sends a notification to the recipient that they have a restricted attachment and attaches the original email to the notification.
The problem I have come across is if the email has both a media and image attachment, the email is classed as restricted and sent to the user as an attachment of notification.
We do not want our users to be able to recieve attachments of type media regardless of what other attachments are in the email.
Has anyone come across this before and do you know of a way to get this to work correctly?

Thanks,

David

pvdberg00 · ‎04-03-2008

If you use two different filters fot this try to combine this in one filter (with OR)

Peter

Wargot_ironport · ‎04-03-2008

I don't think this can be combined into one filter becuase as far as I can see you do not want to notify when quarantining media files.

Couple of things to check:

1. Make sure the Media File content filter is higher in the order than the image content filter.

2. Make sure that you have not clicked on the "Duplicate message" tick box for the "Quarantine Action", if this is ticked then the message continues to be passed to and processed by the other content filters.

If you make sure you check 1 and 2 then this should mean that as soon as a message matches the Media file content filter it is quarantined

lrosenstein · ‎04-03-2008

Hi all,
The problem I have come across is if the email has both a media and image attachment, the email is classed as restricted and sent to the user as an attachment of notification.

Quarantine is not a final action, so this message is probably triggering both filters. You can add a Deliver action to the filter that quarantines media files; this will skip the rest of the content filters.

david.shoesmith · ‎04-03-2008

I would assume that the Deliver action on the Media filter would deliver the email to the end user? This is not what I want to happen.
would it be better to have it Drop the email after it has quarantined it? It would then go into the quarantine area and drop the message?

Thanks for all your suggestions.

Regards,

David

Doc_ironport · ‎04-04-2008

I would assume that the Deliver action on the Media filter would deliver the email to the end user? This is not what I want to happen. 
would it be better to have it Drop the email after it has quarantined it? It would then go into the quarantine area and drop the message?

No, you do actually want "deliver".

When you quarantine something, in effect what happens is that it's marked for delivery to the quarantine rather than the real destination for that message - but not actually sent there at that stage.

When the message gets to the end of the processing, it's then delivered - and will make it's way to the quarantine rather than your mail server.

So by putting a "deliver" directly after the "quarantine" you'll actually deliver it immediately to the quarantine. If you were to use a "drop" then it would be marked for delivery to the quarantine, and then dropped, so it would never make it there.

david.shoesmith · ‎04-07-2008

Thanks for your reply.
That explained it perfectly. I have now got it working as it should be.

Thanks for your help.

David