Missing feature in HEC: define attachment types to be blocked

[Gro_Tea]

Hello,

we are on our way migrating to HEC and in our former SEG we blocked most potentially dangerous files (exe, bat, ...) as well as old MS Office formats like .doc, xls, ppt etc. by default. Now I see that this feature is not availabe in HEC. Why? Is the strategy, that HEC is so good in discovering malware or malicious files, that there is no need to block certain attachments? Not even exe? 

I think it would be worth a feature request for defining attachment types beeing blocked by default.

Thanks,

Frank

[Chris_Atkinson]

Interested in your feedback, why did you do this in your SEG rather than natively in O365/EOP?

As it currently stands this is something we plan to add in the near term to limit multiple points of management for security controls.

[Gro_Tea]

Hi,

this was configured in a combination SEG -> Exchange onprem, prior to moving to O365. We left the configuration there, because we dont want several administrative frontends (SEG, EOP). Would be nice to have the possibility to configure it in HEC.

Frank

[Chris_Atkinson]

Can confirm it's in the near term plans. 🙂

[SimonDrapeau · Accepted solution]

Menu Settings / Anti-Malware Exceptions / Block-List / Create Block-List Rule