topic Re: File Blocking not recognizing .docx or .xlsx files. in General Topics

File Blocking not recognizing .docx or .xlsx files.

Networking2017 — Mon, 09 Aug 2021 15:47:59 GMT

I just created a new file blocking profile and added xlsx, pdf, docx and multi-level-encoding. I set the action to alert. I want to monitor the found traffic prior to implementing a block rule.

When I download a PDF file from the Internet, the vent is logged in the Monitor/Data Filtering.

When I download a .docx or .xlsx file, it is not logged in the Monitoring/Data Filtering.

What am I missing?

Thanks

Re: File Blocking not recognizing .docx or .xlsx files.

Remo — Mon, 09 Aug 2021 16:21:26 GMT

Hi @Networking2017

Docx and xlsx files are basically zip files, so to see the initial file you should also add zip. But to address your problem, try to add another rule to the fileblocking profile where you log all filetypes. This way you should see in the logs which filetypes you need to add also.

Re: File Blocking not recognizing .docx or .xlsx files.

Remo — Mon, 09 Aug 2021 17:47:44 GMT

@Networking2017 do you download the office documents from the same server as the pdf?

Re: File Blocking not recognizing .docx or .xlsx files.

Networking2017 — Mon, 09 Aug 2021 18:27:28 GMT

No. Different servers. I think I need to get decryption working. That way the file blocking can decrypt and see the attachement correctly.

Re: File Blocking not recognizing .docx or .xlsx files.

Remo — Mon, 09 Aug 2021 18:42:31 GMT

@Networking2017 that would have been my next question - the part about decryption ; )

Re: File Blocking not recognizing .docx or .xlsx files.

Networking2017 — Mon, 09 Aug 2021 18:49:21 GMT

Thanks for replying. Do you typically push out the decryption cert using Active Directory or some other method for domain joined computers?

Re: File Blocking not recognizing .docx or .xlsx files.

Remo — Mon, 09 Aug 2021 19:08:00 GMT

Yes, usually with group policies the certs are pushed to the clients. If you use global protect you can also install a cert this way onto the clients that connect to the portal.

Re: File Blocking not recognizing .docx or .xlsx files.

Networking2017 — Fri, 13 Aug 2021 15:23:03 GMT

Once I setup decryption, I was able to block the docx and xlsx files. Thanks.

Another question...If I block the file, is there any way to actually retrieve the blocked file like an email filter does?

Re: File Blocking not recognizing .docx or .xlsx files.

Remo — Fri, 13 Aug 2021 18:42:52 GMT

Paloalto does it's analysis of the traffic atream-based and not with store-and-forward-method (like almost all email gateways operate).

In short, no, unfortunately this is not possible to retrieve the file.