Cisco Cisco Email Security Appliance X1070 Betriebsanweisung
9-32
Cisco AsyncOS 8.5 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
SenderBase Reputation Rule
The
reputation
rule checks the SenderBase Reputation Score against another value. All the comparison
operators are allowed, such as
>
,
==
,
<=,
and so forth. If the message does not have a SenderBase
Reputation Score at all (because one was never checked for it, or because the system failed to get a
response from the SenderBase Reputation Service query server), any comparison against a reputation
fails (the number will not be greater than, less than, equal to, or not equal to any value). You can check
for a SBRS score of “none” using the
response from the SenderBase Reputation Service query server), any comparison against a reputation
fails (the number will not be greater than, less than, equal to, or not equal to any value). You can check
for a SBRS score of “none” using the
no-reputation
rule described below. The following example
adjusts the “Subject:” line of a message to be prefixed by “
*** BadRep ***
” if the reputation score
returned from the SenderBase Reputation Service is below a threshold of -7.5..
For more information, see the “Sender Reputation Filtering” chapter. See also
Values for the SenderBase Reputation rule are -10 through 10, but the value
NONE
may also be returned.
To check specifically for the value
NONE
, use the
no-reputation
rule.
Dictionary Rules
The
dictionary-match(<
dictonary_name>) rule evaluates to
true
if the message body contains any of
the regular expressions or terms in the content dictionary named “dictonary_name.” If the dictionary
does not exist, the rule evaluates to
does not exist, the rule evaluates to
false
. For more information on defining dictionaries (including their
case sensitivity and word boundary settings), see the “Text Resources” chapter.
drop();
}
note_bad_reps:
if (reputation < -7.5) {
strip-header ('Subject');
insert-header ('Subject', '*** BadRep $Reputation *** $Subject');
}
none_rep:
if (no-reputation) {
strip-header ('Subject');
insert-header ('Subject', '*** Reputation = NONE *** $Subject');
}