Cisco Cisco Email Security Appliance X1070 Troubleshooting Guide

Page of 3
What kind of actions can I apply to an email
message using message filters?
Document ID: 118100
Contributed by John Yu and Robert Sherwin, Cisco TAC Engineers.
Jul 29, 2014
Contents
Introduction
What kind of actions can I apply to an email message using message filters?
     Non−Final Actions
     Final Actions
Related Information
Introduction
This document describes actions that can be applied to messages as they are processed through message filters
on the Email Security Appliance (ESA).
What kind of actions can I apply to an email message using
message filters?
Message filters allow you to create special rules describing how to handle messages as they are received by
the ESA.  A message filter specifies that a certain kind of email message should be given special treatment.
Message filters also allow you to enforce corporate email policy by scanning the content of messages for
words you specify.
Message filters support two types of actions: non−final and final. 
Non−final actions performs an action which permits the message to be processed further.  
• 
Final action ends the processing of a message, and permits no further proccessing through subsequent
filters.
• 
Non−final message filter actions are cumulative. If a message matches multiple filters where each filter
specifies a different action, then all actions are accumulated and enforced. However, if a message matches
multiple filters specifying the same action, the prior actions are overridden and the final filter action is
enforced.
Note: Message filters are similar to mail policy content filters, but are configured via the CLI only.  Message
filter are able to take certain actions that are not available to content filters.  Message filters are applied on the
ESA only.
Tip: Please see the "Using Message Filters to Enforce Email Policies" chapter of the AsyncOS User Guide for
complete and detailed information, including message filter examples.