Creating an Attachment Checking rule

To create an Attachment Checking rule:

1. Click on the Attachment Checking node under the Console Root.

2. From the Attachment Checking page (in the right window), click on the Add Rule button.

Screenshot 45 - Attachment Checking: General Tab

3. Specify the name of the rule and select whether to apply this rule to inbound and/or outbound emails by marking the respective check-boxes.

4. Decide on the type of attachment blocking required:

Block all - Select this option to block email attachments of any type.
Block this list - Select this option to block ONLY the listed attachment types.
Block all except this list - Select this option to block attachment types which are not included in the list.

NOTE 1: To add an attachment type to the list, input the required full file name or file extension in the edit box next to the Add button. When ready, click on the Add button. You can use asterisk (*) wildcards to replace characters or strings in the attachment type/extension. For example specifying *orders*.mdb blocks all mdb files which contain the string 'orders' in the file name. Specifying *.jpg will block all jpg files.

NOTE 2: To remove an entry from the list, select it and click on the Remove Selected button.

5. Additionally you can specify a file size in Kbytes as a threshold. This has the effect of blocking all attachments with a file size bigger than the one you specify irrespective of whether it matches an entry in the list. To enable this option, select the Block all files greater than the following size in Kb option and specify the maximum file size (in KB) allowed without blocking.

Screenshot 46 - Attachment Checking: Actions page

6. After you have specified what the attachment rule should check for, you must specify what this rule should do whenever it finds the specified attachment(s). Click on the Actions tab to open the rule actions configuration page.

7. Select the Block attachment and perform this action option if you want to quarantine, delete or move the blocked emails to a particular folder. Additionally, select one of the following options:

Quarantine email: Select this option to quarantine the email containing the attachment for review by an administrator. For more information refer to the `Quarantining' chapter in this manual.
Delete email: Select this option to delete the email and attachment completely.
Move to folder: This option will move the email to the specified folder. Input the folder name in the entry box provided underneath this option.

NOTE: Please note that you cannot configure actions to affect a single attachment within an email. Actions will always and only affect the whole email containing the attachment.

8. Attachment rules can be configured to send email notifications to the administrator and/or user whenever an email containing an attachment is blocked. You can configure the required notifications by selecting any of the following options:

Notify local user: Select this option if you want to send email notifications to the intended recipients whenever an email containing an attachment is blocked.

NOTE: This option will ONLY notify the intended recipients if the blocked email was inbound. If the email was outbound, a notification will be sent to the sender.

Notify administrator: Select this option if you want to send email notifications to the administrator whenever an email containing an attachment is blocked. The administrator's email address is specified during the installation of GFI MailSecurity but can still be changed from the GFI MailSecurity configuration (Console Root } Settings node } General tab). For more information refer to the `Define the administrator's email address' section in the General Settings chapter.

9. Select the Log rule occurrence to this file option if you want to log all rule activity to a specified log file. Input the name of the file in the File name of log file edit box.

NOTE: You can configure an attachment rule using any combination of actions. For example, you can opt not to block emails containing the attachment, but to simply notify the user or log the occurrence to file.

10. Now you must specify the users to whom this rule applies. By default, GFI MailSecurity will apply the rule to all email users. However, if you want this rule to affect a selection of users only, click on the Users/Folders tab.

Screenshot 47 - Attachment Checking: Users/Folders page

11. Choose one of the following options:

Only this list - Select this option if you want to apply this rule to all email users/groups or public folders present in the list.
All except this list - Select this option if you want to apply this rule to all email users, groups or public folders NOT present in the list.

12. To add email users, user groups and/or public folders to the list, click on the Add button.

Screenshot 48 - Add Users Dialog

13. In the add users dialog, specify the name of the email user/user group or public folder that you wish to add to the list.

14. Click on the Check Names button. GFI MailSecurity will now query the Active Directory or the imported list of SMTP addresses (depending on how you installed GFI MailSecurity), to check if the specified entry exists. Subsequently it will return a list of matching results.

NOTE: You do not need to input the full name of the user/user group or public folder. It is enough to enter at least three characters. GFI MailSecurity will list all the names that contain the specified characters. For example, if you input `ott', GFI MailSecurity will return names like `Scott Adams' and `Freeman Prescott`, if they are available.

15. Select the check-box at the start of the listed name(s) to indicate the ones that you wish to add to the list and click on the OK button.

NOTE 1: You can select all the listed names at once by selecting the check-box adjacent to the Name column heading at the top-left of the list.

NOTE 2: Repeat steps 12 to 15 until all the required names are added to the list.

NOTE 3: To remove entries from the list, select the user/user group or folder to be removed and click on the Remove button.

NOTE 4: If no names are included in the list, GFI MailSecurity will automatically apply this rule to all the email users in Active Directory/SMTP address list.

16. Click on the Apply button at the top of the page to activate this rule.