Custom Media Types

Custom Media Types is a list of one or more hexadecimal signatures that can identify a sequence of bytes in a specific position within a file. The position is defined by the offset from either the start or end of the file. It defines a list of hexadecimal signatures that Secure Email Gateway looks for when the list is referenced from a Which Media Types clause in the What To Look For? section of a content rule.

Custom Media Type Signatures

Custom Media Types allows you to define a hexadecimal signature that can be identified at the start or end of a media type file and the offset, in bytes, from the start or end of the file.

When adding a new signature:

• The Signature Pattern cannot be longer than the offset +1, if searching from the end of the file.
• The Signature Pattern must only contain valid hexadecimal values within the range of 0-255.
• Each byte in the Signature Pattern must be separated by a space.
• The value of the offset that the search will start from must be between 0 and 2147483647, where an offset of zero would search from the start or end of a file.

Create a custom media type

1. Navigate to Policy > Policy References > Custom Media Types. The Manage Custom Media Types page is displayed.

2. In the Custom Media Types panel, click New. An editing page for the new custom media type is displayed.

3. In the Overview panel, click Click here to change these settings. Edit the Name and Notes of the custom media type as required, and click Save.

4. In the Signatures panel, click New. The Add Signature dialog is displayed.

5. Configure the Add Signature dialog:

   • Signature Pattern: Specify a signature to search for. You must enter hexadecimal strings separated by a space.

   • From: Specify whether the signature pattern is from the start of the file or end of the file, using the drop-down menu.

   • At Byte Offset: Specify the offset value in bytes.

   Examples of signature

   These examples are based on the following hexadecimal strings at the start and end of a file:

   84 2A 4B 3D 22............20 56 68 00 00 2A 17 4A 65

   Example 1: To identify the value 4A one byte from the end of a file

   • Signature Pattern: Enter 4A
   • From: select end of the file
   • At Byte Offset: Enter 1

   Example 2: To identify the value 20 56 68 00 00 2A 17 4A 65 nine bytes from the end of a file

   • Signature Pattern: Enter 20 56 68 00 00 2A 17 4A 65
   • From: select end of the file
   • At Byte Offset: Enter 9

   Example 3: To identify the value 84 2A 4B 3D 22 at the start of a file

   • Signature Pattern: Enter 84 2A 4B 3D 22
   • From: select start of the file
   • At Byte Offset: Enter 0

   Example 4: To identify the value 4B 3D 22 two bytes from the start of a file

   • Signature Pattern: Enter 4B 3D 22
   • From: select start of the file
   • At Byte Offset: Enter 2

6. Click Add. The new signature is added to the Signatures panel. Add more signatures as required.

7. In the Match All Signatures panel, click Click here to change these settings.

   If you want to match all signatures, select the Only match if all signatures are detected check box. If you want to match any signatures, leave the check box unselected.

8. Click Save.

9. Apply the configuration.

Edit a custom media type

1. Navigate to Policy > Policy References > Custom Media Types. The Manage Custom Media Types page is displayed, listing the existing custom media types.

2. Select the custom media type you wish to modify and click Edit. An editing page for the custom media type is displayed.

3. Modify the Overview, Signatures and Match All Signatures panels as required. Click Save on each panel to save your changes.

4. Apply the configuration.

Delete a custom media type

1. Navigate to Policy > Policy References > Custom Media Types. The Manage Custom Media Types page is displayed, listing the existing custom media types.

2. Select the custom media type you wish to delete and click Delete.

   You cannot delete a policy reference, including Custom Media Types, that is currently used in policy route(s) or content rule(s): A gray check mark () next to the name of the selected item indicates that it is not used by any policy routes or content rules. A green check mark () next to the name of the selected item indicates that it is used by at least one policy route or content rule. To view which policy route(s) or content rule(s) are using the selected item, click Edit instead of Delete. The Usage panel at the top of the editing page shows which policy routes or content rules are currently using the selected item. Modify these policy routes or content rules accordingly to remove references to the selected item.

3. Click Delete in the Confirm Delete dialog to confirm the removal.

4. Apply the configuration.