Enable Attachment Removal

Removed attachments can be replaced with a text file.

Use SSQ insteadIn general, we recommend to enable the SSQ instead of attachment removal. It provides a safer environment and no attachments are lost.

Attachment removal can be activated in different ways:

Verdict based: Remove all attachments from emails classified as Malware or Filter/Policy.
File based: Remove attachments that match certain file criteria (e.g. extension)
Custom rule based: Remove attachments based on arbitrary custom rules - contact support@xorlab.com for this

After an attachment was replaced or removed, the original attachment is deleted and cannot be recovered anymore.

To enable attachment removal or replacement:

Open the activeguard/core/rule_sets/90_local/params/local.properties file in Expert Editor and add:

local.properties

# Global switch for enabling attachment removal/replacement
POLICY_attachment_transform_state=ACTIVE
# Control the file name of the text file which replaces the attachment. Use %s to include the original file name
POLICY_attachment_replace_filename_formatstring=removed-%s.txt

Specify the email direction on which attachment removal is activated:

local.properties

# Supported values: ALL, INCOMING (default) and OUTGOING
POLICY_attachment_transform_direction=INCOMING

For verdict based attachment removal, use the following configuration:

local.properties

# Supported values: keep(default)/remove/replace
# Add only the verdicts where you want to enable attachment removal
POLICY_malware_dynamic=replace
POLICY_malware_static=replace
# Use attachment removal/replacement on filter verdicts with care.
POLICY_attachment_filter=

For file based attachment removal, use the following configuration:

local.properties

# Supported values: keep(default)/remove/replace
POLICY_encrypted_archive_file=
POLICY_excessive_nesting=
# Replace/remove all executable files
POLICY_executable_file=
# Replace/remove all files with blacklisted extensions/hashes/file outputs 
POLICY_file_extension_is_blacklisted= # (1)
POLICY_file_hash_is_blacklisted=
POLICY_file_output_is_blacklisted=
# Replace/remove all flash files
POLICY_flash=
POLICY_legacy_archive_file=
POLICY_html_file=
POLICY_iso_file=
POLICY_office_encrypted=
# Replace/remove all files with VBA script
POLICY_office_vbascript=
# Replace/remove all files with dangerous VBA script (executable, file, network or registry directives)
POLICY_office_dangerous_vbascript=
POLICY_shortcut_file=

Attachment removal based on blacklists only works if the quarantine action for blacklist matches is disabled. If you need help adjusting this setting, contact support@xorlab.com.

For every use case above, you can specify the text in the replacement file with the following properties:

local.properties

# If attachment replacement is enabled, this is the generic fallback text which goes into the text file replacing the file.
POLICY_attachment_replace_text=This attachment got removed as it violated our security policy.
# Specific replacement tests:
POLICY_attachment_replace_text_executable_file=This attachment got removed as it was an executable file and thus violated our security policy.
POLICY_attachment_replace_text_legacy_archive_file=This attachment got removed as it was an archive and thus considered dangerous.
POLICY_attachment_replace_text_excessive_nesting=This attachment got removed because of excessive nesting of files.
POLICY_attachment_replace_text_encrypted_archive_file=This attachment got removed as it was an encrypted archive and thus violated our security policy.
POLICY_attachment_replace_text_file_extension_is_blacklisted=This attachment got removed as it had a blacklisted file extension.
POLICY_attachment_replace_text_file_hash_is_blacklisted=This attachment got removed as it was blacklisted.
POLICY_attachment_replace_text_file_output_is_blacklisted=This attachment got removed as it had a blacklisted file extension.
POLICY_attachment_replace_text_flash=This attachment got removed as it was a flash file and thus violated our security policy.
POLICY_attachment_replace_text_html_file=This attachment got removed as it was a html file and thus violated our security policy.
POLICY_attachment_replace_text_iso_file=This attachment got removed as it was an iso file and thus violated our security policy.
POLICY_attachment_replace_text_office_encrypted=This attachment got removed as it was an office file with encrypted content and thus violated our security policy.
POLICY_attachment_replace_text_office_vbascript=This attachment got removed as it was an office file with active content and thus violated our security policy.
POLICY_attachment_replace_text_shortcut_file=This attachment got removed as it was a shortcut file and thus violated our security policy.
POLICY_attachment_replace_text_office_dangerous_vbascript=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_malware_dynamic=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_malware_static=This attachment got removed as it contained suspicious scripts and thus violated our security policy.
POLICY_attachment_replace_text_filter=This attachment got removed as it violated our security policy.

Click Publish. The rule-set configuration becomes active within about one minute.