Skip to content

Commit 51c3b05

Browse files
committed
Voice and technical updates to malware filter policy cmdlets
1 parent 8a1a723 commit 51c3b05

File tree

2 files changed

+218
-97
lines changed

2 files changed

+218
-97
lines changed

exchange/exchange-ps/exchange/antispam-antimalware/New-MalwareFilterPolicy.md

Lines changed: 106 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,11 @@ Accept wildcard characters: False
8989
### -Action
9090
The Action parameter specifies the action to take when malware is detected in a message. Valid values are:
9191
92-
- DeleteMessage: Deletes the message. This is the default value.
92+
- DeleteMessage: Handles the message without notifying the recipients. This is the default value. In Exchange Server, the message is deleted. In the cloud-based service, the message is quarantined.
9393
94-
- DeleteAttachmentAndUseDefaultAlert: Delivers the message, but replaces the message contents with the default alert text.
94+
- DeleteAttachmentAndUseDefaultAlert: Delivers the message, but replaces the malware attachment with a file named Malware Alert Text.txt that contains the default alert text. In the cloud-based service, the message with the original attachment is also quarantined.
9595
96-
- DeleteAttachmentAndUseCustomAlert: Delivers the message, but replaces the message contents with the custom alert text specified by the AlertText parameter.
97-
98-
Note: For Exchange Online Protection, any of these actions result in the message being delivered. Attachments that contain malware are quarantined. For more information about quarantined messages, see https://docs.microsoft.com/microsoft-365/security/office-365-security/manage-quarantined-messages-and-files.
96+
- DeleteAttachmentAndUseCustomAlert: Delivers the message, but replaces the malware attachment with a file named Malware Alert Text.txt that contains the custom alert text specified by the CustomAlertText parameter. In the cloud-based service, the message with the original attachment is also quarantined.
9997
10098
```yaml
10199
Type: MalwareFilteringAction
@@ -129,7 +127,11 @@ Accept wildcard characters: False
129127
### -BypassInboundMessages
130128
This parameter is available only in on-premises Exchange.
131129
132-
The BypassInboundMessages parameter skips or enforces malware scanning on incoming messages. Valid input for this parameter is $true or $false. The default value is $false. This means malware scanning occurs on incoming messages by default.
130+
The BypassInboundMessages parameter enables or disables malware filtering on incoming messages (messages entering the organization). Valid values are:
131+
132+
- $true: Malware filtering is disabled on inbound messages.
133+
134+
- $false: Malware filtering is enabled on inbound messages. This is the default value.
133135
134136
```yaml
135137
Type: Boolean
@@ -147,7 +149,11 @@ Accept wildcard characters: False
147149
### -BypassOutboundMessages
148150
This parameter is available only in on-premises Exchange.
149151
150-
The BypassOutboundMessages parameter skips or enforces malware scanning on outgoing messages. Valid input for this parameter is $true or $false. The default value is $false. This means malware scanning occurs on outgoing messages by default.
152+
The BypassOutboundMessages parameter enables or disables malware filtering on outgoing messages (messages leaving the organization). Valid values are:
153+
154+
- $true: Malware filtering is disabled on outbound messages.
155+
156+
- $false: Malware filtering is enabled on outbound messages. This is the default value.
151157
152158
```yaml
153159
Type: Boolean
@@ -183,7 +189,9 @@ Accept wildcard characters: False
183189
```
184190
185191
### -CustomAlertText
186-
The CustomAlertText parameter specifies the custom alert text to insert in the message when malware is detected and the value of the Action parameter is set to ReplaceWithCustomAlert. This parameter is required when the CustomNotifications parameter is set to $true.
192+
The CustomAlertText parameter specifies the custom text to use in the replacement attachment named Malware Alert Text.txt. If the value contains spaces, enclose the value in quotation marks (").
193+
194+
This parameter is only meaningful when the Action parameter value is ReplaceWithCustomAlert.
187195
188196
```yaml
189197
Type: String
@@ -199,7 +207,13 @@ Accept wildcard characters: False
199207
```
200208
201209
### -CustomExternalBody
202-
The CustomExternalBody parameter specifies the body of the custom notification message that's sent to an external sender when a message contains malware. This parameter is required when the CustomNotifications parameter is set to $true.
210+
The CustomExternalBody parameter specifies the body of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks (").
211+
212+
This parameter is only meaningful when the CustomNotifications parameter value is $true, and at least one of the following parameter values is also $true:
213+
214+
- EnableExternalSenderAdminNotifications
215+
216+
- EnableExternalSenderNotifications
203217
204218
```yaml
205219
Type: String
@@ -215,7 +229,13 @@ Accept wildcard characters: False
215229
```
216230
217231
### -CustomExternalSubject
218-
The CustomExternalSubject parameter specifies the subject of the custom notification message that's sent to an external sender when a message contains malware. This parameter is required when the CustomNotifications parameter is set to $true.
232+
The CustomExternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks (").
233+
234+
This parameter is only meaningful when the CustomNotifications parameter value is $true, and at least one of the following parameter values is also $true:
235+
236+
- EnableExternalSenderAdminNotifications
237+
238+
- EnableExternalSenderNotifications
219239
220240
```yaml
221241
Type: String
@@ -231,7 +251,17 @@ Accept wildcard characters: False
231251
```
232252
233253
### -CustomFromAddress
234-
The CustomFromAddress parameter specifies the From address of the custom notification message that's sent to an internal or external sender when a message contains malware. This parameter is required when the CustomNotifications parameter is set to $true.
254+
The CustomFromAddress parameter specifies the From address of the custom notification message for malware detections in messages from internal or external senders.
255+
256+
This parameter is only meaningful when the CustomNotifications parameter value is $true, and at least one of the following parameter values is also $true:
257+
258+
- EnableExternalSenderAdminNotifications
259+
260+
- EnableExternalSenderNotifications
261+
262+
- EnableInternalSenderAdminNotifications
263+
264+
- EnableInternalSenderNotifications
235265
236266
```yaml
237267
Type: SmtpAddress
@@ -247,7 +277,17 @@ Accept wildcard characters: False
247277
```
248278
249279
### -CustomFromName
250-
The CustomExternalFromName parameter specifies the From name of the custom notification message that's sent to internal or external senders when a message contains malware. This parameter is required when the CustomNotifications parameter is set to $true.
280+
The CustomFromName parameter specifies the From name of the custom notification message for malware detections in messages from internal or external senders. If the value contains spaces, enclose the value in quotation marks (").
281+
282+
This parameter is only meaningful when the CustomNotifications parameter value is $true, and at least one of the following parameter values is also $true:
283+
284+
- EnableExternalSenderAdminNotifications
285+
286+
- EnableExternalSenderNotifications
287+
288+
- EnableInternalSenderAdminNotifications
289+
290+
- EnableInternalSenderNotifications
251291
252292
```yaml
253293
Type: String
@@ -263,7 +303,13 @@ Accept wildcard characters: False
263303
```
264304
265305
### -CustomInternalBody
266-
The CustomInternalBody parameter specifies the body of the custom notification message that's sent to an internal sender when a message contains malware. This parameter is required when the CustomNotifications parameter is set to $true.
306+
The CustomInternalBody parameter specifies the body of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks (").
307+
308+
This parameter is only meaningful when the CustomNotifications parameter value is $true, and at least one of the following parameter values is also $true:
309+
310+
- EnableInternalSenderAdminNotifications
311+
312+
- EnableInternalSenderNotifications
267313
268314
```yaml
269315
Type: String
@@ -279,7 +325,13 @@ Accept wildcard characters: False
279325
```
280326
281327
### -CustomInternalSubject
282-
The CustomInternalSubject parameter specifies the subject of the custom notification message that's sent to an internal sender when a message contains malware. This parameter is required when the CustomNotifications parameter is set to $true.
328+
The CustomInternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks (").
329+
330+
This parameter is only meaningful when the CustomNotifications parameter value is $true, and at least one of the following parameter values is also $true:
331+
332+
- EnableInternalSenderAdminNotifications
333+
334+
- EnableInternalSenderNotifications
283335
284336
```yaml
285337
Type: String
@@ -295,9 +347,11 @@ Accept wildcard characters: False
295347
```
296348
297349
### -CustomNotifications
298-
The CustomNotifications parameter enables or disables the custom notification message to the sender when the message contains malware. Valid input for this parameter is $true or $false. The default value is $false.
350+
The CustomNotifications parameter enables or disables custom notification messages for malware detections in messages from internal or external senders. Valid values are:
299351
300-
If you enable custom notification messages by setting this parameter to $true, you specify the details of the custom notification message using the CustomFromAddress,CustomFromName, CustomExternalSubject, CustomExternalBody, CustomInternalSubject and CustomInternalBody parameters.
352+
- $true: When malware is detected in a message, a custom notification message is sent to the message sender. You specify the details of message using the CustomFromAddress, CustomFromName, CustomExternalSubject, CustomExternalBody, CustomInternalSubject and CustomInternalBody parameters.
353+
354+
- $false: Custom notifications to the original message sender are disabled. This is the default value. Default notification messages are sent if the EnableExternalSenderNotifications and EnableInternalSenderNotifications parameters are set to $true.
301355
302356
```yaml
303357
Type: Boolean
@@ -331,9 +385,11 @@ Accept wildcard characters: False
331385
```
332386
333387
### -EnableExternalSenderAdminNotifications
334-
The EnableExternalSenderAdminNotifications parameter enables or disables sending notification messages to an administrator when malware is detected in messages from external senders. Valid input for this parameter is $true or $false. The default value is $false.
388+
The EnableExternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from external senders. Valid values are:
389+
390+
- $true: When malware is detected in messages from external senders, send notification messages to the email address that's specified by the ExternalSenderAdminAddress parameter. You can customize the notification message using the CustomFromAddress, CustomFromName, CustomExternalBody, and CustomExternalSubject parameters.
335391
336-
Specify the administrator to receive the notification messages by using the ExternalSenderAdminAddress parameter.
392+
- $false: When malware is detected in messages from external senders, don't send administrator notifications. This is the default value.
337393
338394
```yaml
339395
Type: Boolean
@@ -349,7 +405,11 @@ Accept wildcard characters: False
349405
```
350406
351407
### -EnableExternalSenderNotifications
352-
The EnableExternalSenderNotifications parameter enables or disables sending notification messages to senders when malware is detected in messages from external senders. Valid input for this parameter is $true or $false. The default value is $false.
408+
The EnableExternalSenderNotifications parameter enables or disables notification messages for malware detections in messages from external senders. Valid values are:
409+
410+
- $true: When malware is detected in a message from an external sender, send them a notification message. You can customize the notification message using the CustomFromAddress, CustomFromName, CustomExternalBody, and CustomExternalSubject parameters.
411+
412+
- $false: Don't send malware detection notification messages to external message senders. This is the default value.
353413
354414
```yaml
355415
Type: Boolean
@@ -365,13 +425,11 @@ Accept wildcard characters: False
365425
```
366426
367427
### -EnableFileFilter
368-
The EnableFileFilter parameter enables or disables common attachment blocking. Valid values are:
369-
370-
- $true: Common attachment blocking is enabled.
428+
The EnableFileFilter parameter enables or disables common attachment blocking (also known as the Common Attachment Types Filter). Valid values are:
371429
372-
- $false: Common attachment blocking is disabled.
430+
- $true: Common attachment blocking is enabled. The file types are defined by the FileTypes parameter.
373431
374-
To configure the blocked file types, use the FileTypes parameter.
432+
- $false: Common attachment blocking is disabled. This is the default value.
375433
376434
```yaml
377435
Type: Boolean
@@ -387,9 +445,11 @@ Accept wildcard characters: False
387445
```
388446
389447
### -EnableInternalSenderAdminNotifications
390-
The EnableExternalSenderAdminNotifications parameter enables or disables sending notification messages to an administrator when malware is detected in messages from internal senders. Valid input for this parameter is $true or $false. The default value is $false.
448+
The EnableInternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from internal senders. Valid values are:
391449
392-
Specify the administrator to receive the notification messages by using the InternalSenderAdminAddress parameter.
450+
- $true: When malware is detected in messages from internal senders, send notification messages to the email address that's specified by the InternalSenderAdminAddress parameter. You can customize the notification message using the CustomFromAddress, CustomFromName, CustomInternalBody, and CustomInternalSubject parameters.
451+
452+
- $false: When malware is detected in messages from internal senders, don't send administrator notifications. This is the default value.
393453
394454
```yaml
395455
Type: Boolean
@@ -405,7 +465,11 @@ Accept wildcard characters: False
405465
```
406466
407467
### -EnableInternalSenderNotifications
408-
The EnableExternalSenderAdminNotifications parameter enables or disables sending notification messages to senders when malware is detected in messages from internal senders. Valid input for this parameter is $true or $false. The default value is $false.
468+
The EnableInternalSenderNotifications parameter enables or disables notification messages for malware detections in messages from internal senders. Valid values are:
469+
470+
- $true: When malware is detected in a message from an internal sender, send them a notification message. You can customize the notification message using the CustomFromAddress, CustomFromName, CustomInternalBody, and CustomInternalSubject parameters.
471+
472+
- $false: Don't send malware detection notification messages to internal message senders. This is the default value.
409473
410474
```yaml
411475
Type: Boolean
@@ -437,31 +501,31 @@ Accept wildcard characters: False
437501
```
438502
439503
### -FileTypes
440-
The FileTypes parameter specifies the file types that are blocked by common attachment blocking. The default values are:
504+
The FileTypes parameter specifies the file types that are automatically blocked by common attachment blocking (also known as the Common Attachment Types Filter), regardless of content. The default values are:
441505
442-
- ace
506+
- .ace
443507
444-
- ani
508+
- .ani
445509
446-
- app
510+
- .app
447511
448-
- docm
512+
- .docm
449513
450-
- exe
514+
- .exe
451515
452-
- jar
516+
- .jar
453517
454-
- reg
518+
- .reg
455519
456-
- scr
520+
- .scr
457521
458-
- vbe
522+
- .vbe
459523
460-
- vbs
524+
- .vbs
461525
462526
You enable or disable common attachment blocking by using the EnableFileFilter parameter.
463527
464-
Common attachment blocking uses best effort true-typing to detect the file type regardless of the file name extension. If true-typing fails or isn't supported for the specified file type, then extension matching is used. For example, ps1 files are Windows PowerShell scripts, but their true type is text.
528+
Common attachment blocking uses best effort true-typing to detect the file type regardless of the file name extension. If true-typing fails or isn't supported for the specified file type, then extension matching is used. For example, .ps1 files are Windows PowerShell scripts, but their true type is text.
465529
466530
To replace the existing list of file types with the values you specify, use the syntax \<FileType1\>,\<FileType2\>,...\<FileTypeN\>. To preserve existing values, be sure to include the file types that you want to keep along with the new values that you want to add.
467531
@@ -481,7 +545,9 @@ Accept wildcard characters: False
481545
```
482546
483547
### -InternalSenderAdminAddress
484-
The InternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notifications messages when messages from external senders contain malware. Notification messages are sent to the specified email address only if the EnableInternalSenderAdminNotifications parameter is set to $true.
548+
The InternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from internal senders.
549+
550+
This parameter is only meaningful if the EnableInternalSenderAdminNotifications parameter value is $true.
485551
486552
```yaml
487553
Type: SmtpAddress

0 commit comments

Comments
 (0)