Cisco Cisco Email Security Appliance X1070 User Guide

attachment-contains(<regular 

>)

Does the message contain an attachment that 
contains text or another attachment that matches 
a specific pattern? Does the pattern occur the 
minimum number of times you specified for the 
threshold value? 

This rule is similar to the 

body-contains()

 rule, 

but it attempts to avoid scanning the entire 
“body” of the message. That is, it attempts to 
scan only that which the user would view as 
being an attachment. See 

attachment-binary-contains(<

>)

Does the message contain an attachment with 
binary data that matches a specific pattern?  

This rule is like the 

attachment-contains ()

 

rule, but it searches specifically for patterns in 
the binary data. 

every-attachment-contains(<r

>)

Do all of the attachments in this message contain 
text that matches a specific pattern? The text 
must exist in all attachments and the action 
performed is, in effect, a logical AND operation 
of an '

attachment-contains()

' for each 

attachment. The body is not scanned. Does the 
pattern occur the minimum number of times you 
specified for the threshold value? 

attachment-size

Does the message contain an attachment whose 
size is within some range? This rule is similar to 
the 

body-size

 rule, but it attempts to avoid 

scanning the entire “body” of the message. That 
is, it attempts to scan only that which the user 
would view as being an attachment. The size is 
evaluated prior to any decoding. See 

dnslist(<query server>)

Does the sender’s IP address appear on a public 
blacklist server (RBL)? See 

reputation

What is the sender’s SenderBase Reputation 
Score? See 

no-reputation

Used to test if SenderBase Reputation Score is 
“None.” See