We need to update a filtering policy to have multiple conditions. We are currently blocking all executable files with a content filter rule that says:
Condition: If the attachment or body part is in the attachment list "Executable Files"
Action: Delete Message
We have some senders who should be able to send us executable files. We have created a dictionary which is a mixture of email address and domains. We want to use specific email addresses when possible to limit the number of addresses that can send us EXEs. The condition section that lets you filter by dictionary makes you choose between email addresses and domains so I haven't been able to build a complete filter that has both sub conditions
What I need to create is a condition that looks like:
If the attachment or body part is in the attachment list "Executable Files"
AND (
If text in Envelope sender part of the message header does not contain Domain name from dictionary "Active Content bypass"
OR
If text in Envelope sender part of the message header does not contain email address from dictionary "Active Content bypass"
)
Any thought on how I can achieve this?