LogSat Software

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   I noticed this in the release notes.
// New to VersionNumber = '4.7.2.196';
{TODO
 -cNew : Added the attachment filename to the message parts that 
SpamFilter scans for keywords, allowing the blacklisting/whitelisting of
 attachment filenames using keywords as well}

This means we can do something like this in the keyword rules:
attachment:*.exe

Something like that?  Is there any example or documentation on how to use this new feature?  I would be interested in using it.

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
yapadu Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 12 May 2005 Status: Offline Points: 297	Post Options Post Reply Quote yapadu Report Post Thanks(0) Quote Reply Topic: attachment filename Posted: 06 June 2016 at 10:20pm
	I noticed this in the release notes. // New to VersionNumber = '4.7.2.196'; {TODO -cNew : Added the attachment filename to the message parts that SpamFilter scans for keywords, allowing the blacklisting/whitelisting of attachment filenames using keywords as well} This means we can do something like this in the keyword rules: attachment:*.exe Something like that? Is there any example or documentation on how to use this new feature? I would be interested in using it.
	-------------------------------------------------------------- I am a user of SF, not an employee. Use any advice offered at your own risk.

LogSat Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 25 January 2005 Location: United States Status: Offline Points: 4104	Post Options Post Reply Quote LogSat Report Post Thanks(0) Quote Reply Posted: 07 June 2016 at 9:02am
	In the past, if an email had this content: ------=_NextPart_000_0023_01C7D2C3.DADB76A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit this is a test for a pdf ------=_NextPart_000_0023_01C7D2C3.DADB76A0 Content-Type: application/pdf; name="SCADAWhitepaperfinal1.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Whitepaperfinal1.pdf" JVBERi0xLjINJeLjz9MNCjMxIDAgb2JqDTw8IA0vTGluZWFyaXplZCAxIA0vTyAzMyANL0ggWyAx SpamFilter would normalize the content and search for keywords in this new text: content-type: text/plain content-transfer-encoding: 7bit content-type: application/pdf content-transfer-encoding: base64 content-disposition: attachment this is a test for a pdf Prior to this version, there was a bug in SpamFilter where the name and filename portions of the Content-Type and Content-Disposition would not be included in the normalized text if they appeared (as is in most cases) in a separate indented line. From this version on, we're specifically adding the filename and name in the normalized text: content-type: text/plain content-transfer-encoding: 7bit content-type: application/pdf content-transfer-encoding: base64 content-disposition: attachment filename="scadawhitepaperfinal1.pdf" name="scadawhitepaperfinal1.pdf" this is a test for a pdf so they can be searched along with other keywords. Edited by LogSat - 07 June 2016 at 9:03am
	Roberto Franceschetti LogSat Software Spam Filter ISP

yapadu Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 12 May 2005 Status: Offline Points: 297	Post Options Post Reply Quote yapadu Report Post Thanks(0) Quote Reply Posted: 07 June 2016 at 12:06pm
	Oh OK, that explains why I have never had much luck filtering on filenames/attachments in the past. Using this new information I looked up what type of attachments gmail does not allow and built a rule that stops any mail from gmail.com that contains one of their restricted attachment types. So far it has stopped 1 message, so looks like it is at least working.
	-------------------------------------------------------------- I am a user of SF, not an employee. Use any advice offered at your own risk.

LogSat Software

Site Navigation[Skip]

Spam Filter ISP Support Forum

attachment filename