Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

filter attachments by name

Hi All,

I'd like my c100 Ironport appliances to filter (strip?) attachments of a certain name.

I don't want to filter by file extension (ie. vbs, scr, etc.), only by the full filenames.

I have a list of 20+ files I'd like the Ironport to lookout for, then strip and quarentine said files until an admin can review, release or delete.

I'm not seeing an easy way to accomplish this, short of creating a filter for each file...which isn't terribly efficient.

Thanks in advance.

2 REPLIES
New Member

Re: filter attachments by name

Unfortunately, there isn't a way that you can say this:

if attachment-filename contains terms in dictionary....and then list those filenames in the dictionary.

action:
quarantine('Policy');

What you can do, though laborious, if put them all out:


Option 1: (for different extensions)
if attachment-filename contains "(file1.txt|file2.doc|file3.xls|file4.zip)"

action:
quarantine('Policy');


Option 2: (for same extensions)

if attachment-filename contains "(file1|file2|file3|file4).txt"

action:
quarantine('Policy');


Hi All, 

I'd like my c100 Ironport appliances to filter (strip?) attachments of a certain name.

I don't want to filter by file extension (ie. vbs, scr, etc.), only by the full filenames.

I have a list of 20+ files I'd like the Ironport to lookout for, then strip and quarentine said files until an admin can review, release or delete.

I'm not seeing an easy way to accomplish this, short of creating a filter for each file...which isn't terribly efficient.

Thanks in advance.

New Member

Re: filter attachments by name

I'm trying to do this exact thing and I'm running into some problems.  I've created the following message filter but it doesn't appear to be working.  Has anyone successfully got a message filter to work based on a dictionary file which the filter references and grabs the filename of the attachment and quarantines it?

Thanks,

Mike

545
Views
0
Helpful
2
Replies