Cisco Cisco Email Security Appliance X1070 Information Guide

Is there a filter condition matching on the file size
of single attachment(s) instead of message size?

Document ID: 118558

Contributed by Cisco TAC Engineers.
Oct 13, 2014

Contents

Introduction
Is there a filter condition matching on the file size of single attachment(s) instead of message size?
Related Information

Introduction

This document describes a solution to match on attachment file size in a filter condition.

Is there a filter condition matching on the file size of single
attachment(s) instead of message size?

On the Cisco Email Security Appliance (ESA), there is no option in Message Filters or Content Filters to
match on attachment file size in a filter condition. The only size related condition is the Message
Size condition, which is taking the size of the complete message into consideration.

The solution is to make use of the $filesizes Action Variable, which contains a comma separated list of the file
size of all attachments contained in a message. If a X−header is added to the message with the value of
$filesizes then a Regular Expression (RegEx) can be constructed to match if any of the contained numbers
(file sizes) exceeds a certain value.

The example below shows the setup of a content filter that drops a message if the size of attachment(s) equals
to or exceeds 10000 bytes:

Create a Content Filter to add the value of the "$filesizes" action variable in a X−header: