Review Static Policies

Below you find the static policies that are active by default. Normally, they do not need to be changed.

Disabling a static policy

To disable one of the static policies below, add a corresponding line to local.properties:

local.properties

# Syntax: <Rule name>_state=PASSIVE
FILTER_iso_state=PASSIVE

Static policy (`FILTER` rule)	Description
`FILTER_executable`	Quarantine all emails with executable files
`FILTER_flash`	Quarantine all emails with flash files
`FILTER_iso`	Quarantine all emails with ISO files
`FILTER_legacy_archive`	Quarantine all emails with archive files that are considered legacy
`FILTER_shortcut`	Quarantine all emails with shortcut files
`FILTER_windows_script`	Quarantine all emails with windows scripts
`FILTER_office_dde`	Quarantine all emails with Office documents containing Dynamic Data Exchange (DDE) fields
`FILTER_office_external_frame`	Quarantine all emails with Office documents containing external frame(s)
`FILTER_office_external_webvideo`	Quarantine all emails with Office documents containing external videos
`FILTER_wwwdata_sender`	Quarantine all emails where the sender’s FROM address is matched by this regex: `.www-data.`
`FILTER_UNTRUSTED_new_file_type_from_unknown_sender`	Quarantine all emails from unknown senders that contain new file types. A new file type means that it has not been seen yet in trusted communication

The file extensions blocked by each static policy are documented in Detection Defaults → Static policy file extensions. Access to that page is restricted.

Malware rules still apply: Even if the above static policies (filters) are disabled, xorlab will still block the majority of their associated file types because of the built-in malware rules. Malware rules depend on the relationship, for example they might block a script file from an untrusted sender, but allow it from a partner. With the static policy, you can enforce blocking it independently of the relationship.