Cisco Cisco Email Security Appliance C170 User Guide
14-11
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Chapter 14 Text Resources
For scanning headers, you can use the appropriate
*-dictionary-match()
-type
rule (there are rules for specific headers, such as
subject-dictionary-match()
and a more generic rule,
header-dictionary-match()
, in which you can specify
any header including custom headers). See “Dictionary Rules” in the “Using
Message Filters to Enforce Email Policies” chapter of the Cisco IronPort
AsyncOS for Email Advanced Configuration Guide for more information about
dictionary matching.
Message Filters to Enforce Email Policies” chapter of the Cisco IronPort
AsyncOS for Email Advanced Configuration Guide for more information about
dictionary matching.
In the following example, a new message filter using the
dictionary-match()
rule is created to blind carbon copy the administrator when the Cisco IronPort
appliance scans a message that contains any words within the dictionary named
“secret_words” (created in the previous example). Note that because of the
settings, only messages that contain the whole word “
appliance scans a message that contains any words within the dictionary named
“secret_words” (created in the previous example). Note that because of the
settings, only messages that contain the whole word “
codename
” matching the
case exactly will evaluate to true for this filter.
In this example, we send the message to the Policy quarantine:
Table 14-1
Message Filter Rules for Content Dictionaries
Rule
Syntax Description
Dictionary Match
dictionary-match(<dict
ionary_name>)
Does the message contain a word
that matches all the regular
expressions listed in the named
dictionary?
that matches all the regular
expressions listed in the named
dictionary?
bcc_codenames:
if (dictionary-match ('secret_words'))
{
bcc('administrator@example.com');
}
quarantine_codenames:
if (dictionary-match ('secret_words'))
{