OfficeScan 10.6 Administrator's Guide - Trend Micro™ Online Help

Managing Data Protection and Using Digital Asset Control
Events that Trigger Decompression Rules
The following events trigger decompression rules:
Event 1:
A compressed file to be transmitted matches a policy and the action on the compressed
file is Pass (transmit the file).
For example, to monitor .ZIP files that users are transmitting, you defined a file attribute
(.ZIP), added it to a template, used the template in a policy, and then set the action to
Pass.
Note: If the action is Block, the entire compressed file is not transmitted and therefore,
there is no need to scan the files it contains.
Event 2:
A compressed file to be transmitted does not match a policy.
In this case, OfficeScan will still subject the compressed file to the decompression rules
to determine which of the files it contains should be scanned for digital assets and
whether to transmit the entire compressed file.
Result:
Events 1 and 2 have the same result. When OfficeScan encounters a compressed file:
• If Rule 1 is not satisfied, OfficeScan allows the transmission of the entire
compressed file.
• If Rule 1 is satisfied, the other two rules are checked. OfficeScan allows the
transmission of the entire compressed file if:
• All scanned files do not match a policy.
• All scanned files match a policy and the action is Pass.
The transmission of the entire compressed file is blocked if at least one scanned file
matches a policy and the action is Block.
9-63