Cisco Cisco Email Security Appliance X1070 Information Guide
How do I create a content filter that applies to *all*
incoming or outgoing mail ... ?
incoming or outgoing mail ... ?
Document ID: 117901
Contributed by Tomki Camp and Enrico Werner, Cisco TAC Engineers.
Jul 08, 2014
Contents
Question
Question
How do I create a content filter that applies to *all* incoming or outgoing mail, and not just a specific group
of senders or recipients?
of senders or recipients?
There are several ways of accomplishing what you want to do. If you want to apply a filter to all incoming
mail (for example) or all outgoing mail, you can do this either as a message filter or a content filter.
mail (for example) or all outgoing mail, you can do this either as a message filter or a content filter.
Content filters are applied as the last Policy processing step in the email pipeline − after messages have been
'splintered' into separate copies depending on the Mail Policies (and therefore different recipient groups)
defined in your configuration. Because of this, Content Filters can be applied to a more finely−grained
grouping of senders or recipients.
'splintered' into separate copies depending on the Mail Policies (and therefore different recipient groups)
defined in your configuration. Because of this, Content Filters can be applied to a more finely−grained
grouping of senders or recipients.
It is important to remember that content filters are managed by the GUI on the Mail Policies−>Incoming
Content Filters or Mail Policies−>Outgoing Content Filters page.
Content Filters or Mail Policies−>Outgoing Content Filters page.
The (true) syntax in the following filter example:
if (true)
{
}
causes all instructions / statements included in the {}'s to be executed every time the filter is applied.
After creating the filter, you must apply it to Incoming Mail Policies for it to take effect. Note that there are
two options here: one is to place the filter in the Default policy, the other is to replicate it in all policies. If
you place the filter in the Default Policy, any other policy which is set to (use default) will also have the filter
applied. If you have policies that do not use the default content filters, you will have to edit each one to
include the filter.
two options here: one is to place the filter in the Default policy, the other is to replicate it in all policies. If
you place the filter in the Default Policy, any other policy which is set to (use default) will also have the filter
applied. If you have policies that do not use the default content filters, you will have to edit each one to
include the filter.
Aside: in a long list of content filters, it's a nice shortcut to define the order of a newly created content filter as
"1" so that it can quickly be added to all policies (and be executed first). Order matters...
"1" so that it can quickly be added to all policies (and be executed first). Order matters...
Another way to filter incoming mail is with a message filter. Message filters are applied as the first Policy
processing step in the ESA email pipeline. When a Message Filter is applied, its actions apply to all recipients
of the message (i.e. if the action is Drop, then no recipient will receive the message, even if the rule which
matched the message matched only one recipient.)
processing step in the ESA email pipeline. When a Message Filter is applied, its actions apply to all recipients
of the message (i.e. if the action is Drop, then no recipient will receive the message, even if the rule which
matched the message matched only one recipient.)