6.3 Creating an Anti-Virus Policy

Creating a policy manually involves:

  1. Creating the policy

  2. Setting the policy priority, messages move through the policies from top to bottom

  3. Set the policy message scan direction

  4. Configuring the policy with filters, services and exceptions

For this example we will assume that a supplier has an overly enthusiastic marketing department and orders to reduce the amount of unwanted mail but allowing the desired mail through have come down.

In this case, the Inbound Mail Filter Policy is a wizard created policy that deals with general spam, and malware. However, unwanted message are getting through and need to be dealt with.

6.3.1 Create the Policy

Under Organization / Policy Management | Policy Management, click Add New to create a new policy and name it something easy to remember like Anti-Virus Inbound Policy.

6.3.2 Set the Policy Message Direction

Open the panel and enable Scan by message direction then enable Handle inbound mail.

6.3.3 Configure the Scanner

  1. Open the Policy scan configuration folder and select the policy. The workbench will be empty.

  2. Add the Filter

    There are two filters that will block viruses: Anti-Virus and Zero Hour Virus.

  3. Anti-Virus scans for known virus signatures and is updated no longer than hourly.

    Zero Hour Virus uses a heuristic method of determining if the traits of a virus exist in a message. This functionality used to be combined into the Anti-Virus scanner. This may trigger false positives, so it has been broken out into its own filter so exceptions may be created while continuing to keep the attack surface as small as possible.

  4. Drag the filters to the Workbench.

  5. The filter will now scan messages for the word “unsubscribe”, but without one or more services nothing will be done with the message.

  6. Add Service

  7. Select the Services tab.

  8. Because we do not want viruses to enter the system, drag and drop the Block service to the workbench, or drag and drop the red Services pin and select Block.

  9. Connect the Red Services pin to the service with drop and drop.

  10. Press Save.

  11. Items with viruses will now be blocked.