How to block email with executable attachments and store in approval box.

03/26/2020 1,021 People found this article helpful 197,040 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

If you want to block emails with executable attachments and store them in a separate location in email security which will be only visible to administrators then approval boxes are the best choice for you. You can create an approval box and store emails in that approval box using a filter.

NOTE: Approval box feature requires compliance module license. So make sure that you have compliance module license on email security else you will not be able to access the approval box page.Follow these steps to block emails with dangerous attachment and store them in approval box.

Resolution

Step 1: Go to Manage| Policy & Compliance | Compliance | Approval Boxes and click on add new approval box as shown below


You can change the default action as per your requirement as shown in below image. My recommendation is to delete after 30 days so old emails don't occupy hard disk space for longer than 30 days.



Description of default actions -
None - It will not perform any action on the message. The message will stay in approval box until an administrator either approves it or deletes it.
Approve and Deliver - This will approve the message automatically after the specified period of time and will deliver it. (I would not recommend this option to you).
Delete - This will delete the message after the specified period.
Bounce Back to Sender - This will bounce back the email to the sender after the specified period of time.

You can set alerts for emails those arrive in approval box as shown in below image for Frequency of notifications:. My recommendation is to notify the sender when an email arrives.


Step 2. Go to Manage | Policy & Compliance | Filters | Click on add new filter. Select conditions as shown below.



If you can't read the text in image then you can find those conditions below in text format.

• Enable this filter: It should be checked.
• If "Any" of these conditions are met:
• Select: Attachment Contents
• Matching: Contain executables
• Action: Store in Approval Box
• Approval Box: Dangerous Attachments
• Filter name: Store Dangerous attachments in approval box
• Apply this filter to: Apply to everyone

Click save this filter once you are done.

Once you create this filter it will start blocking emails with executables inside zip attachments and they will be stored in approval box. Admin can go to Policy & Compliance | Compliance | Approval Boxes and view these emails any time.

Related Articles

• Network Security Essentials eLearning Training Course
• How do I check if syslogs are getting forwarded by an Email Security Appliance?
• How to add inbound path in Hosted Email Security

Categories

• Email Security > Email Security Appliance
• Email Security > Email Security Software
• Email Security > Hosted Email Security