This document describes the feature "Safe Print" on the Cisco Email Security Appliance (ESA).
Safe Print feature is available in ESA AsyncOS 13.0 and newer versions.
The configuration of Safe Print will involve the basic understanding of content filter behavior.
The Email Security Appliance can be configured to provide a safe view (safe-printed PDF version) of a message attachment detected as malicious or suspicious. The safe view of the message attachment is delivered to the end-user and the original attachment is stripped from the message. The 'Safe Print' content filter action provides a variety of options based on the content filter condition.
The ability to safe print message attachments in the email gateway helps an organization to:
Prevent message attachments with malicious or suspicious content from entering an organization network.
View malicious or suspicious message attachments without being affected by malware.
Deliver the original message attachment based on the end-user request.
What Safe Print does.
Scan messages up to the size of the Scan Config "Maximum attachment size to scan field," with a max of 6M.
Print the attachment (approved file types), to an image pdf.
Print up to 10 pages of the original file.
Add an optional watermark and Cover Page to the rewritten attachment.
The current User Guide provides more in-depth detail of the Safe Print Feature within the Chapter, "Configuring Email Gateway to Safe Print Message attachments."
Configure Safe Print
There are 3 areas to configure Safe Print.
#1 Safe Print Parameters
#2 Create a Content Filter
#3 Apply the Content Filter to an Inbound Mail Policy
#1 Safe Print Parameters
a. WebUI browse to > Security Services > Scan Behavior > Edit Global Settings.
b. Make note of the value in the blue box.
c. Safe Print "Maximum File Size," will take action on files up to 6M, but must be less than the value in the blue box.
Note: Supported file types may increase with future AsyncOS releases.
g. Cover Page: May contain a maximum of 800 characters.
Scan Behavior > Edit Global Settings > Cover Page
h. Watermark: May contain a maximum of 20 characters.
i. Submit > Commit Changes.
Sample Cover Page
#2 Create a Content Filter
Safe Print actions will be achieved through the use of Content Filter and the Action, "Safe Print."
Note: The Content Filters will only scan the file types configured in section 1f above, Scan Behavior.
There are three choices within the Action, "Safe Print."
Safeprint all attachments: If a Condition matches triggering the Safe Print Action, all attachments get rewritten.
Commonly applied to content filter conditions matching on the "Message Body," and/or "Attachments."
This option is very flexible and will function with any condition within a Content Filter.
Example: Condition - Remote IP/Hostname, If matched will rewrite all attachments.
Safeprint matching attachments: Only take action on the specific attachment(s) matching the condition.
This Action has restricted "Choices," for Conditions.
Commonly used for content filters with conditions focused on the attachment content.
This option can only be used with the following Conditions.
URL Reputation (Check within: Attachment) only this option.
URL Category (Check within: Attachment) only this option.
Attachment File Info
Strip unscannable attachments.
As stated, if an attachment is unscannable, this action will strip the attachment.
Customer Replacement Message field offers an optional space adding words, phrases to notify.
Content Filter Action > Safe Print
Using the above Content Filter Introduction, begin creating a CF.
Tip: Consider the 3 Safe Print choices and associated condition restrictions, mentioned above, as you create the filter.
a. WebUI > Browse to > Mail Policies > Incoming Content Filters > Add Filter.
b. Add Condition: The condition depends on the 3 choices for the Safe Print Action.
c. (Optional Action, very much recommended) Add Action > Quarantine > Duplicate message > Choose the custom quarantine you created for
Safe Print. Choose OK to add.
Action > Quarantine > Duplicate message
Tip: DUPLICATE to Quarantine. As a fail-safe action, consider copying the message to quarantine with the original attachment. If an attachment performs a Safe Print rewrite, this action will act as insurance for any documents you determine to be of value even if they match the conditions. Create a custom Quarantine specifically for Safe Print for easy identification.
c. Add Action > Safe Print
i. Choose the Safe Print Choice that corresponds with the Conditions.
d. (Optional) Add Action - Add Log entry and include text which will reflect in the Message Tracking to confirm a match.
i. Examples: use special characters to highlight for visibility, Add a description or filter name to identify - # Safe Print # or >> Safe Print <<
e. Submit to create the content filter. Commit Changes to save to the ESA.
Sample Safe Print Content Filter
Log entries specific to Safe Print Message Processing.
MID 95 The attachment(s) are successfully safe-printed, Filename(s): Create_Certificate_for=20Amp.docx MID 95 rewritten to MID 96 by safeprint-matching-attachments-strip-unscan filter 'SP_type'
Reporting View from the Next Generation Reporting (ng)
Allows the user to click numbers and redirect to Message Tracking using a new browser tab.
NG Report Safe Print
Tracking criteria from Report Redirect Action
Search Results from Report redirect action
Advanced Search Option - Safe Print
Mail Logs at Trace Level: Display alerts.
Cisco Internal Information (access controlled / confidential)
The Process runs by the namesafeprintand is controlled similar to other process by Heimdall