How to create a filter to block specific extensions
| Situation | You want to create a filter rule for specific extensions and/or filenames and block them from end users. |
|---|---|
| Solution | Follow the below steps to create a new Inbound or Outbound filter to filter specific extensions. |
Review on filters
Consider reviewing these articles for a more broad view on our filters:
Please note that this is not to be confused with the pre-defined filter libraries, which scans for mime/types as well. This is to create a filter based off an extension. This process, you can specifically create a filter to block, like a *.dll file.
How to create a filter to block a specific Extension
Follow these steps to create the filter.
- Navigate to Security Settings > Email > Filter Policies.
- Click Inbound or Outbound depending on which direction you wish to block.
- For Filter Name, enter an appropriate name.
- Ensure the Direction dropdown has the desired option selected.
- Click Continue.
- From the Scope drowdown, select the desired option (i.e. Company or specific users/groups).
- For If, select Attachment Name.
- For the next operator, select IS.
- In the Text Box, input the file extension name you want to block.
- Examples to block all zip files: *.zip, *.7z, *.rar
- Block pictures: *.jpg, *.jpeg, *.png (Threat actors are now adding an ending period to File extensions. For example instead of .htm they add .htm. You may also want to add *.htm. or whatever your file extension name followed by a comma, for multiple files to prevent that from happening.)
- From the Do dropdown, select Quarantine.
To create an Allow condition in the place of Quarantine choose Allow.
11. You can optionally add in the section to Stop processing additional filters.
12. Click Save.
After you click Save, the filter will be enabled and you will return to the filters page. You will see a note confirming Filter added.