ESA Does Not Show Email Attachment Information in the Message Tracking

Introduction

This document describes an issue with the Cisco Email Security Appliance (ESA) when email attachment information does not appear in the message tracking and describes some possible solutions to the problem.

Problem

You receive an email with a valid attachment. If there is no body scanner, or no attachment scanning message filters or content filters are in place, the email attachment does not appear in the message tracking. In the message tracking, you see Attachments: N/A:

If the attachment information does not appear in the message tracking, it does not indicate that the ESA has dropped the attachment. The attachment is still visible, but the appliance does not have the necessary scanners for attempts to scan the email body in order to identify the attachment.

Solution 

This problem occurs because the content scanning engine does not actively scan attachments. Complete these steps in order to enable the message tracking to display the attachment information:

1. Configure at least one message or content filter that is able to scan for attachment information, name, type, or size. Alternatively, make any needed alterations to the attachments.
   
   
2. Configure a body scanner that checks for the names, strings, characters, and sizes.
   
   
3. Configure a disclaimer, or similar, that prints new information from the footers or headers into the body of the email or performs some form of email body modification.

Example Filters

This section describes some possible filter options. You can use any of the filters that are outlined by the boxes in the next image, as they require the appliance to perform some form of attachment or body scanning:

Once you create the filter(s), the message tracking should indicate the email attachments, as shown: