We've recently installed Ironport for email successfully and transferred a lot of our old rules from our content filtering system. One of our business's requirements is that we flag any images sent / received over a certain size. This, on our old system, was a simple rule for if attachment = image, and attachment is over xx Kb then notify.
A way to do this badly would be to match a content filter on both Message size & image attached, but this will create too many false positives with documents attached & a smaller image which matched the filter.
So I'm looking for some way, if possible, to match a certain attachment type over a certain size. Is this something which regex can help with? I've tried a string which matches the attachment header but can't make that work - not sure if Ironport doesn't scan that part, either in full message plus body or attachment alone.
I've seen something on the web about the web edition which can flag on certain sizes of certain files (e.g. don't allow .zip files over 300Kb) but nothing for the email edition.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...