filter attachments by name

Unanswered Question
May 7th, 2008

Hi All,

I'd like my c100 Ironport appliances to filter (strip?) attachments of a certain name.

I don't want to filter by file extension (ie. vbs, scr, etc.), only by the full filenames.

I have a list of 20+ files I'd like the Ironport to lookout for, then strip and quarentine said files until an admin can review, release or delete.

I'm not seeing an easy way to accomplish this, short of creating a filter for each file...which isn't terribly efficient.

Thanks in advance.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
kluu_ironport Wed, 05/07/2008 - 23:50

Unfortunately, there isn't a way that you can say this:

if attachment-filename contains terms in dictionary....and then list those filenames in the dictionary.

action:
quarantine('Policy');

What you can do, though laborious, if put them all out:


Option 1: (for different extensions)
if attachment-filename contains "(file1.txt|file2.doc|file3.xls|file4.zip)"

action:
quarantine('Policy');


Option 2: (for same extensions)

if attachment-filename contains "(file1|file2|file3|file4).txt"

action:
quarantine('Policy');


Hi All, 

I'd like my c100 Ironport appliances to filter (strip?) attachments of a certain name.

I don't want to filter by file extension (ie. vbs, scr, etc.), only by the full filenames.

I have a list of 20+ files I'd like the Ironport to lookout for, then strip and quarentine said files until an admin can review, release or delete.

I'm not seeing an easy way to accomplish this, short of creating a filter for each file...which isn't terribly efficient.

Thanks in advance.
Mike Kwilosz Mon, 04/09/2012 - 15:55

I'm trying to do this exact thing and I'm running into some problems.  I've created the following message filter but it doesn't appear to be working.  Has anyone successfully got a message filter to work based on a dictionary file which the filter references and grabs the filename of the attachment and quarantines it?

Thanks,

Mike

Actions

This Discussion