Cisco Cisco Email Security Appliance X1050 Fehlerbehebungsanleitung
Image Analysis Feature
Document ID: 118557
Contributed by Cisco TAC Engineers.
Oct 13, 2014
Contents
Introduction
View the Verdict Score of a Particular Message
Related Information
View the Verdict Score of a Particular Message
Related Information
Introduction
Image Analysis is an extra feature that needs to be licensed in order to be enabled and used on the Cisco
Email Security Appliance (ESA).
Email Security Appliance (ESA).
Some messages contain images that you may wish to scan for inappropriate content. You can use the image
analysis engine to search for inappropriate content in email. Image analysis is not designed to supplement or
replace your anti−virus and anti−spam scanning engines. Its purpose is to enforce acceptable use by
identifying inappropriate content in email. Use the image analysis scanning engine to quarantine and analyze
mail and to detect trends.
analysis engine to search for inappropriate content in email. Image analysis is not designed to supplement or
replace your anti−virus and anti−spam scanning engines. Its purpose is to enforce acceptable use by
identifying inappropriate content in email. Use the image analysis scanning engine to quarantine and analyze
mail and to detect trends.
After you configure AsyncOS for image analysis, you can use image analysis filter rules to perform actions on
suspect or inappropriate emails. Image scanning allows you to scan the following types of attached files:
JPEG, BMP, PNG, TIFF, GIF, TGA, ICO, and PCX. The image analyzer uses algorithms that measure skin
color, body size and curvature to determine the probability that the graphic contains inappropriate content.
When you scan image attachments, Cisco fingerprinting determines the file type, and the image analyzer uses
algorithms to analyze the image content. If the image is embedded in another file, the Stellent scanning engine
extracts the file. The Stellent scanning engine can extract images from many file types, including Word,
Excel, and PowerPoint documents. The image analysis verdict is computed on the message as a whole. If the
message does not include any images, the message receives a score of ?0? which maps to a ?clean? verdict.
Therefore, a message without any images will receive a "clean" verdict.
suspect or inappropriate emails. Image scanning allows you to scan the following types of attached files:
JPEG, BMP, PNG, TIFF, GIF, TGA, ICO, and PCX. The image analyzer uses algorithms that measure skin
color, body size and curvature to determine the probability that the graphic contains inappropriate content.
When you scan image attachments, Cisco fingerprinting determines the file type, and the image analyzer uses
algorithms to analyze the image content. If the image is embedded in another file, the Stellent scanning engine
extracts the file. The Stellent scanning engine can extract images from many file types, including Word,
Excel, and PowerPoint documents. The image analysis verdict is computed on the message as a whole. If the
message does not include any images, the message receives a score of ?0? which maps to a ?clean? verdict.
Therefore, a message without any images will receive a "clean" verdict.
Note: Images cannot be extracted from PDF files.
View the Verdict Score of a Particular Message
To see the verdict score for a particular message, you can view the mail logs. The mail logs display the image
name or file name, the score for a particular message attachment. In addition, the log displays information
about whether the images in a file were scannable or unscannable. Note that information in the log describes
the result for each message attachment, rather than each image. For example, if the message had a zip
attachment that contained a JPEG image, the log entry would contain the name of the zip file rather than the
name of the JPEG. Also, if the zip file included multiple images then the log entry would include the
maximum score of all the images. The unscannable notation indicates whether any of the images were
unscannable.
name or file name, the score for a particular message attachment. In addition, the log displays information
about whether the images in a file were scannable or unscannable. Note that information in the log describes
the result for each message attachment, rather than each image. For example, if the message had a zip
attachment that contained a JPEG image, the log entry would contain the name of the zip file rather than the
name of the JPEG. Also, if the zip file included multiple images then the log entry would include the
maximum score of all the images. The unscannable notation indicates whether any of the images were
unscannable.
The log does not contain information about how the scores translate to a particular verdict (clean, suspect or
inappropriate). However, because you can use mail logs to track the delivery of specific messages, you can
inappropriate). However, because you can use mail logs to track the delivery of specific messages, you can