To create a park attachment rule

Steps

  1. Click Add Rule.
  2. Define whether the rule should be initially enabled or disabled.
  3. Enter a Rule name.
  4. Select an Attachment size and a Message size from the drop-down lists. For example, you might choose to park any attachment with a size of 2MB or larger in messages that are 3MB or larger in size.
    You can also select Ignore for either of these options, for example if you want all attachments larger than a certain size to be parked regardless of the message size.
  5. Choose how long the parked message should be stored for. The default is 7 days.
  6. Define whether the system should keep a copy of the original message.
  7. Under Apply To, define who the rule affects. By default, the rule applies to all the senders (for an outbound rule) or recipients (for an inbound rule) in the policy. Alternatively you can apply the rule to only the senders or recipients that you specify. Enter the domains, addresses, or groups to include, separated by commas.
  8. To excludes certain sender and recipients from your rule, select Exclude these senders and recipients, then list the domains, addresses, or groups to exclude, separated by commas. For example, you can specify that a rule does not apply if an email is from xyz@externaldomain.com or is sent to xyz@internaldomain.com. You can enter up to 65,535 characters.
  9. Under Annotations, you can edit the annotation that appears in the original message sent to the recipient. A default annotation like the one below is included.
    The attachment attach1-2100.txt (2.1 MB) was parked. It can be retrieved from here.

    In addition, you can include the following variables:

    Variables/tokens Description
    _RECIPIENTS_ The intended recipients of the message.
    _DATE_ The date Forcepoint Email Security Cloud received the email that generated the annotation. This date is based on the time zone set on the Notification Email screen.
    _SENDER_ The message originator.
    _SUBJECT_ The subject line of the message that is being annotated.
    _ATTACH_TYPE_ The file type of the attachment parked.
    _NAME_ The name of the attachment parked.
    _RETRIEVE_END_ Used in HTML annotations surrounding some text that displays as a link. For example, “It can be retrieved from_RETRIEVE_START_here_RETRIEVE END.”
    _RETRIEVE_START_

    Used in HTML annotations surrounding some text that displays as a link. For example, “It can be retrieved from

    _RETRIEVE_START_here_RETRIEVE_END.”
    _RETRIEVE_LINK_

    Used to include a link to download the attachment. For example, “It can be retrieved from

    _RETRIEVE_LINK_.”
    _SIZE_ The size of the attachment parked.

    Click on Variables/tokens to select these variables from the drop-down list.

  10. Under Notification Options, select who should be notified about the parked attachment. In all cases, you have the option to include the original message with the notification.
  11. Click Submit when done.
    After a rule has been created and enabled, you have the option to add parking by file format or type. See Park attachments by file type.