Cisco Cisco Email Security Appliance C160 Betriebsanweisung
Chapter 6 Using Message Filters to Enforce Email Policies
6-80
Cisco IronPort AsyncOS 7.5 for Email Advanced Configuration Guide
OL-25137-01
You can also use the $MatchedContent action variable to notify senders or
administrators that a content filter was triggered. The $MatchedContent action
variable displays the content that triggered the filter. For example, the following
filter sends a notification to an administrator if the email contains ABA account
information.
administrators that a content filter was triggered. The $MatchedContent action
variable displays the content that triggered the filter. For example, the following
filter sends a notification to an administrator if the email contains ABA account
information.
Notification Template
You can use the Text Resources page or the
textconfig
CLI command to
configure custom notification templates as text resources for use with the
notify()
and
notify-copy()
actions. If you do not create a custom notification
template, a default template is used. The default template includes message
headers, but the custom notification template does not include message headers
by default. To include message headers in the custom notification, include the
headers, but the custom notification template does not include message headers
by default. To include message headers in the custom notification, include the
$AllHeaders
action variable.
For more information, see the “Text Resources” chapter in the Cisco IronPort
AsyncOS for Email Configuration Guide.
AsyncOS for Email Configuration Guide.
in the following example, when a large message triggers the filter shown below,
an email is sent to the intended recipients explaining that the message was too
large:
an email is sent to the intended recipients explaining that the message was too
large:
ABA_filter:
if (body-contains ('*aba')){
notify('admin@example.com','[$MatchedContent]Account Information
Displayed');
}
bigFilter:
if (body-size >= 4M)
{
notify('$EnvelopeRecipients', '[$FilterName] Message too large',
'$EnvelopeFrom', 'message.too.large');