File Blocking not recognizing .docx or .xlsx files.

[Networking2017]

I just created a new file blocking profile and added xlsx, pdf, docx and multi-level-encoding.  I set the action to alert.  I want to monitor the found traffic prior to implementing a block rule.

When I download a PDF file from the Internet, the vent is logged in the Monitor/Data Filtering.

When I download a .docx or .xlsx file, it is not logged in  the Monitoring/Data Filtering.

What am I missing?

Thanks

[Remo]

Hi @Networking2017 

Docx and xlsx files are basically zip files, so to see the initial file you should also add zip. But to address your problem, try to add another rule to the fileblocking profile where you log all filetypes. This way you should see in the logs which filetypes you need to add also. 

[Remo]

@Networking2017 do you download the office documents from the same server as the pdf?

[Networking2017]

No.  Different servers.  I think I need to get decryption working.  That way the file blocking can decrypt and see the attachement correctly.

[Remo]

@Networking2017 that would have been my next question - the part about decryption ; )

[Networking2017]

Thanks for replying.  Do you typically push out the decryption cert using Active Directory or some other method for domain joined computers?

[Remo]

Yes, usually with group policies the certs are pushed to the clients. If you use global protect you can also install a cert this way onto the clients that connect to the portal.

[Networking2017]

Once I setup decryption, I was able to block the docx and xlsx files.  Thanks.

Another question...If I block the file, is there any way to actually retrieve the blocked file like an email filter does?

[Remo]

Paloalto does it's analysis of the traffic atream-based and not with store-and-forward-method (like almost all email gateways operate).

In short, no, unfortunately this is not possible to retrieve the file.