Policies - Blocked Stripped and Linked Attachments

This article provides an overview of what happens if an attachment is blocked, or stripped and linked, by one of the following policies:

Policy	Description
Configuring Attachment Management Definitions and Configuring Attachment Management Policies	Allows individual attachment types to be blocked, linked or held using an attachment set.
Configuring Attachment Block on Size Policies	Removes attachments based on the cumulative size of the attachments.
Configuring Attachment Hold on Size Policies	Holds the email based on the cumulative size of the attachments.
Configuring Attachment Link on Size Policies	Strips and Links all attachments based on the cumulative size of the attachments.

For attachments held by Targeted Threat Protection - Attachment Protect, see the Targeted Threat Protection – Attachment Protect page.

Any attachment that is blocked or stripped and linked from a message based on an attachment policy is logged and available for release by an administrator using stripped attachments. Attachment policies are based on mail flow and can be applied to both inbound and outbound mail. Blocked or stripped and linked attachments are available in the archive until the message's expiry date. See the Retention Adjustments page for full details.

When an attachment is blocked or stripped and linked, the internal end user is notified. Administrators can review and release either the:

• Attachment, which will be delivered with a system notification.
• Original message, which is delivered to the recipient.

Considerations

Consider the following when configuring any of the following policies:

• If you have the Targeted Threat Protection - Attachment Protect product on your Mimecast account, you can release attachments to the sandbox.
• You can limit messages based on the total size of the message, including all attachments. The policies listed above only affect individual attachments.

Viewing Messages with Stripped Attachments

Messages with stripped attachments sent by Large File Send can be tracked using a separate viewer. See the "Large File Send Attachments" section below for full details.

To view attachments that have been removed from messages:

1. Log on to the Mimecast Administration Console.
2. Navigate to Email Security | Attachments. The following information regarding the message and its attachments is displayed:

Column

Description

Attempt From

Displays the sender's email address.

Deliver To

Displays the recipient's email address.

File Name

Displays the blocked or stripped and linked attachment file name.

Ext

Displays the blocked or stripped and linked attachment file extension. This refers to the actual MIME type of the attachment, so if the file type has been renamed, the actual file type is displayed.

Size

Displays the blocked or stripped and linked attachment size.

Date Time

Displays the message's date and time.

Status

Displays an icon indicating the attachment's status:

Icon	Attachment Status	Description
	Attachment Linked	The attachment has been removed from the message as a result of a strip and link action. This could be because of an Attachment Link on Size policy or by selecting the link option in an Attachment Set. The end user receives the original message with a system notification attachment. A HTTPS hyperlink is provided for the end user to download the attachment directly from Mimecast.
	Attachment Released	The attachment, or the original message with an attachment, has been released by an administrator to the end user.
	Attachment Blocked	The attachment has been blocked by an Attachment Management or Attachment Block on Size policy.

Use the search field to filter the view. You can search for the from/to address or filename. By default, stripped attachments display one month's worth of attachments. You can also change the date range by using the "From" and "To" calendar controls.

Additional information is provided when a message is selected, including the message status and the details of the attachment. The "Released" field indicates if the attachment has been released by an administrator. It is only displayed for messages with attachments blocked by:

• Attachment Block on Size policy.
• Attachment Management policy with the "Deny" option enabled.

Releasing Messages and Attachments

To release an attachment:

1. Log in to the Mimecast Administration Console.
2. Navigate to Email Security | Attachments.
3. Right-click on the Message.
4. Select one of the following menu items:

Option	Description
Release Original Message	Releases the original message with attachment to the end user, which maintains the context of the attachment.
Release Attachment	Releases the attachment via a system notification to the end user.
View Attachment Detail	Displays the stripped attachment review page as displayed above.
View Email Data	Displays the contents of the message and allows you to preview the attachment prior to releasing it to the end user.

You can select multiple attachments to be released by using the check box next to each item and selecting the Release Attachment button on the top toolbar.

Released Attachments Log

When an item is released from stripped attachments, an entry is listed in the Released Attachments Log. To view the log:

1. Log in to the Mimecast Administration Console.
2. Navigate to Email Security | Attachments.
3. Click on the View | Release Log menu option. The release log is displayed for the last month by default and provides the following information:

Column	Description
Released By	Displays the email address of the user who released the attachment. This can be an end user if the attachment was released via a digest or the administrator.
Attachment Name	The full file name of the attachment.
Released To	The email address to which the attachment was delivered.
Method	Specifies how the attachment was released. The possible values are "Self Release" if the attachment was released via a digest, or "Administration Console" if released by an administrator.
Type	Displays if it was the original message or attachment that was released.
Date Time	Displays the time and date that the message was released.

You can customize the Attachment Block and Attachment Release notifications. For more information, refer to the Introduction of a Default Notification Set Service Update.

Large File Send Attachments

Large File Send services can be enabled through Mimecast for Outlook and Mimecast for Mac when composing new messages, or by Attachment Management policies. Large File Send attachments are not transmitted through the company email server but are instead sent directly through Mimecast. This helps to reduce the load on the server and user applications.

Large File Send attachments can be released from this viewer by those with content viewing rights.

Users can monitor the Large File Send files from the Mimecast ribbon in Mimecast for Outlook or from the Large File Send manager in Mimecast for Mac. Administrators can monitor these files from the Mimecast Administration Console:

1. Log in to the Mimecast Administration Console.
2. Navigate to Email Security | Attachments.
3. Click on the Large File Send Attachments button.
4. Select a File to view more details on the file, including the email receipt/delivery details.

See Also...

• Targeted Threat Protection - Attachment Protection Overview