Configuring multimedia file detection

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

 

Resolution

Your organization might want to prohibit users from receiving the email messages that contain multimedia file attachments, such as music and video files. When you enable the Multimedia File Rule, Mail Security detects the supported file extensions and types and takes the actions that you specify. Mail Security can determine if a file is a true multimedia file by analyzing the file contents, rather than looking at the file name extension. Blocking multimedia file attachments not only helps your organization enforce content policies, it also conserves scanning and file storage resources.

Note:

Mail Security can determine the true file type of a well-formed binary file. The true file type of a binary file variant cannot always be accurately determined.

Table: Supported multimedia file types lists the multimedia file types that Mail Security supports (this list cannot be modified).

Table: Supported multimedia file types

File type	File extension
Amiga MED/OctaMED Tracker Module Sound File	*.MED
AU Audio File, Audacity Audio Block	*.AU
Audio Interchange File	*.AIFF, *.AIFC, *.AIF
Audio Video Interleave File	*.AVI
Impulse Tracker Music Module	*.IT
MPEG AlbumWrap Wrapped Music File Archive	*.MP3, *.MP4
MPEG Movie Clip, MPEG-4 Audio Layer File	*.MPEG
MultiTracker Music Module	*.MTM
Musical Instrument Digital Interface	*.MIDI
MusicEase Audio File	*.MEZ
QuickTime Video Clip	*.QT, *.MOV
RealMedia File	*.RA
OGG Vorbis Codec Compressed WAV File	*.OGG
Scream Tracker Music Interface Kit Song/Module	*.STX
ScreamTracker v3 Sound File	*.S3M
Shock Wave Flash	*.SWF
Shorten Audio Compression File	*.SHN
Waveform Audio	*.WAV
Windows Media File	*.WMV

To configure multimedia file detection

1. In the console on the primary navigation bar, click Policies.

2. In the sidebar under Content Enforcement, click File Filtering Rules.

3. In the content area, in the File Filtering Rules table, click Multimedia File Rule.

4. In the content area, in the File Filtering Rules table, on the Multimedia File Rule row, click the box under the Status column, and then use the drop-down menu to select Enabled.

   This rule is disabled by default.

5. In the preview pane, in the Action to take list, use the drop-down menu to select one of the following to specify the action to take when a multimedia file is detected:

   • Delete entire message

   • Delete attachment/message body and replace with text

   • Quarantine entire message and replace with text

   • Quarantine attachment/message body and replace with text

   • Log only

   The default setting is: Quarantine entire message and replace with text.

6. In the Replacement text box, type your customized message if you want to replace the message or the attachment body with a text message.

   The default text is: Symantec Mail Security replaced %attachment% with this text message. The original file contained %violation% and was %action%.

   See Alert and notification variables

7. Check one or more of the following to send email notifications about the detection:

   • Notify administrators

     Click the down arrow and then type your customized text in the Subject line box and the Message body box.

     The default subject line and message body text is as follows:

     • Default subject line text: Administrator Alert: Symantec Mail Security detected a message containing prohibited attachment

     • Default message body text: Symantec Mail Security replaced %attachment% with this text message. The original file contained %violation% and was %action%

   • Notify internal sender

     Click the down arrow and then type your customized text in the Subject line box and the Message body box.

     The default subject line and message body text is as follows:

     • Default subject line text: Symantec Mail Security detected a prohibited attachment in a message sent from your address

     • Default message body text: Subject of the message: %subject% Recipient of the message: %recipient%

   • Notify external sender

     Click the down arrow and then type your customized text in the Subject line box and the Message body box.

     The default subject line and message body text is as follows:

     • Default subject line text: Symantec Mail Security detected a prohibited attachment in a message sent from your address

     • Default message body text: Subject of the message: %subject% Recipient of the message: %recipient%

     See Alert and notification variables

8. On the toolbar, click Deploy changes to apply your changes.

   See Deploying settings and changes to a server or group