Cisco Cisco Email Security Appliance X1050 Informationshandbuch

Contributed by Cisco TAC Engineers.

Oct 13, 2014

This document describes how to allow some messages from a sender with a low SBRS score, but block all
other messages.

In Mail Policies > HAT Overview, add a new Sender Group. Add a name, such
as, "Temporarily_Accept".  Then add this as a sender, ".example.net".  (You are adding this hostname
or IP address.)

1. 

Order this new Sender Group so that it is above the Blacklist Sender Group.

2. 

Create the following message filter from the CLI of your appliance:

temporary_accept:

if ( mail−from == '(?i)joe@example.net' )

{

deliver();

}

3. 

Create a message filter that enforces the Blacklist Sender Group policy:

enforce_blacklist_sbrs:

if ( reputation < −2 )

{

drop();

}

4. 

Note: The order of the message filters are important, so make sure that your message filter as written in step
#3 is above the message filter as written in step #4.

Note: SBRS of −2 is the general standard score used for Blacklist.  You may need to check what your specific
settings is. (Mail Policies > HAT Overview > Blacklist Sender Group)

Here is a summary of what the above HAT Overview sendergroup and message filters do: