This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocking ODT file formats also blocks Office docs

After reading an article alerting to the fact that malicious actors are now using OpenDocument file types to bypass filters, I decided to add each of the Open Document file types to a restricted attachment rule within our SEA which strips the attachment from emails where the attachment meets a certain file type or name:

*.odt

*.ods

*.odp

*.odg

*.odf

However as soon as I did this, the SEA started blocking all .docx and .xlsx files.

Would anyone know why?

This thread was automatically locked due to age.

0 Jaydeep over 5 years ago

Hi Papadug

What do you see in the Email logs for that blocked Email? Does it indicate being blocked due to the same additional policy you've created?

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel
0 Papadug over 5 years ago in reply to Jaydeep

Hi Jaydeep,

Yes the MS Office files are quarantined by the same additional policy that I add the *.odt, etc extensions to. As soon as I remove the ODT file formats from the policy the MS Office files stop being quarantined.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaydeep over 5 years ago in reply to Papadug

Hi Papadug

Apologies for the delayed response.

Would you please create a case with Sophos Support for this and provide me the case ID? It looks to be something that needs an investigation of logs in SEA which would be possible with the support team.

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel
0 Papadug over 5 years ago in reply to Jaydeep

Hi Jaydeep,

I've logged case 36039538 for this.

Thanks for your help
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaydeep over 5 years ago in reply to Papadug

Hi Papadug

Thanks for the case ID but that does not look like a case number. Would you please confirm if the case was created with Sophos support or your local partner? Please DM me for any questions or any details you would like to share.

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel
0 Papadug over 5 years ago in reply to Jaydeep

Sorry Jaydeep You're right, the actual case number is #9347290

I logged the call myself via sophserv.sophos.com and picked the wrong number as I was running out the office last night!
Cancel
Vote Up 0 Vote Down

Cancel