help with smb - malware - content

Hello guys,

My rule:

 - I have a rule that delete a message with virus (attach)

 - I have a rule for content that check the attach for denied extension. If match, so, a quarantine incident is created, because maybe some users need to receive dll or another type of file...

But, If the message is detected like a virus, so, it should be deleted for real, without create the incident, do you agree?

But, how can I configure it to work like I said above?

Thanks,

Diego