ESET Mail Security - to add some improvements

[SLV 0]

Hello ESET!

I have some questions / ideas for ESET Mail Security for Exchange.  Maybe you have special form or topic for suggestions (wish list), please share it.

1.  Could you please add in rules one more environment variable - %From%.  I see it is available %EnvelopeSender% and even %ReplyTo%, but I can't find variable for HeaderFrom, 

2. Separate Attachments scan result from "Antivirus scan result" in rule conditions. Now after attachment processing rules the result will be "Infected - cleaned" even for non-infected files like multimedia or archive files in attachments.  This is not logic. 

3. Add new type of attachments - "Password protected PDF"

4. Add exception in conditions for rules. To create logic like "If some conditions are True except other conditions do Actions"

Thank you in advance.

[M.K. 18]

Hello,
the environment variable you mentioned should already work. Maybe the documentation hasn't been updated, but this is the list of currently supported macros (case insensitive):
%ENVELOPESENDER%
%ENVELOPEDOMAIN%
%FROMADDRESS%
%FROMDOMAIN%
%REPLYTOADDRESS%
%REPLYTODOMAIN%

Ad #2 and #3 - will look at that.

Ad #4 - all conditions should have a way how to define them also as a negation, i.e. "is" vs "is not", "contain" vs "doesn't contain" etc... Do you have some example where you can't define the rule now in a way that you want?

[SLV 0]

1 hour ago, M.K. said:

Hello,
the environment variable you mentioned should already work. Maybe the documentation hasn't been updated, but this is the list of currently supported macros (case insensitive):
%ENVELOPESENDER%
%ENVELOPEDOMAIN%
%FROMADDRESS%
%FROMDOMAIN%
%REPLYTOADDRESS%
%REPLYTODOMAIN%

Ad #2 and #3 - will look at that.

Ad #4 - all conditions should have a way how to define them also as a negation, i.e. "is" vs "is not", "contain" vs "doesn't contain" etc... Do you have some example where you can't define the rule now in a way that you want?

Thanks for new variables, we will try them.

Regarding #4

Yes, we use that negation logic but in some cases will be more practical to use general exception.

[SLV 0]

Unfortunately, at least %FROMADDRESS% doesn't work in actions "Send event notification to administrator" and "Log to events".  At the same time %EnvelopeSender% and %ReplyTo% works well.

[SLV 0]

22 hours ago, M.K. said:

%FROMDOMAIN%

It looks like %FROMADDRESS% doesn't supported in rule actions. Could you please check this as well.

 

It would be very useful to have in rule actions environment variable %HeaderFromDisplayName%, Could you please add it as well.

[M.K. 18]

Ad %FROMADDRESS%: we will add all missing expandable macros to rule actions in the upcoming feature release.

Ad. Exceptions for conditions in rules: we track this feature in our backlog. It didn't have a very high priority compared to other requirements, as there is a workaround available for most cases and we didn't want to overcomplicate the current design of rules. It's possible we will re-prioritize it again in the future.

Ad. Infected status for attachments blocked by rules - we are aware of this situation and are analyzing possible solutions.