Rules-based processing of password-protected archive files

Up to now, all password-protected archive files in the iQ.Suite Exchange/SMTP have always been transferred to iQ.Suite’s badmail quarantine. With iQ.Suite 8 Exchange/SMTP, these files can now be processed using a rules-based methodology. And this is how it’s done.

Step by Step:

• The new iQ.Suite watchdog job type "Watchdog Protected Attachment Detection" supports rules-based processing of password-protected archive files. This job type allows password-protected archive files to be incorporated into the standard iQ.Suite rule set. This means that all the iQ.Suite actions are available when files of this nature are identified. Up to now, these files were always placed in iQ.Suite’s badmail quarantine and a message sent to the iQ.Suite administrator.
• To create a job of this type via the context menu, select "Watchdog Protected Attachment Detection".

• If, for example, you now want all password-protected archives to be moved to a dedicated quarantine in future, you just need to set the address rule "All senders" to "All recipients".

• It is, of course, possible to authorise these files for use by certain users/groups and block them for others. To this end, you can create several iQ.Suite jobs for these files.
• You can use the "Actions" tab to configure the actions to be executed when password-protected archive files are identified.

• The iQ.Suite jobs responsible for verifying password-protected archives should appear at the start of the iQ.Suite job chain. Why? Because emails processed by these jobs are regarded as legitimate by the downstream virus scanning or attachment blocking jobs and are, therefore, not checked again for scanability. This ensures that the emails, having already been checked upstream, are not placed in the badmail quarantine by these jobs.