Rule creation for different cycles of the connection

[nWatne]

I'm looking to create a very targeted and unique rule where when a certain criteria is met in the response cycle AND another criteria is met in the embedded object cycle, we take action.  Is there a way to accomplish this?

For example: We want to block a zip file (response) that contains a VBS file type in that zip file (embedded object).  If a VBS file is being downloaded outright and not in a zip file, we allow it.  Likewise, if a generic ZIP file is being downloaded, we all it. 

I've got a rule that blocks a file type based on MediaType.FromFileExtension.  However, the cycle when it is determined to be a ZIP file happens in the response cycle.  The content inside of that ZIP file isn't evaluated until the embedded object cycle.  I am not able to create a rule that says, MediaType.FromFileExtension=zip AND MediaType.FromFileExtension=vbs because both criteria won't match on the same cycle. 

Any suggestions are appreciated!

[mkutrieba]

Hello,

so far I know, this is not possible as every embedded object is a dedicated cycle as you mentioned.

Maybe I do not correctly understand this but why do you want this?
As per:
"We want to block a zip file (response) that contains a VBS file type in that zip file (embedded object)"
Does this mean that you want to allow regular VBS files and only block them if they are embedded in other files such as ZIP?

For example: If you check for Mediatype.FromFileExtension or for MediaType.EnsuredTypes contains VBS, then VBS files will always be blocked. Does not matter if it is a plain VBS file or an embedded object in a ZIP file. In last case, entire connection/download of ZIP will then be blocked even if embedded object 165 is the VBS file.

[swilkens1]

Sounds like all you are looking for is this:

Name:
Block embedded VBS files

Rule Criteria:
Cycle.Name equals "EmbeddedObject" AND
MediaType.EnsuredTypes contains application/vbs

Action:
Block

Is this correct? This way, VBS files that are the root object will not be blocked, but if they are found as an object embedded in an archive, this rule's criteria will match and block.