Cisco Cisco Email Security Appliance C190 User Guide

Cisco AsyncOS 9.1 for Email 사용 설명서

9 장     메시지 필터를 사용하여 이메일 정책 적용

  메시지 필터 규칙

효율적인 필터 작성

이 예는 동일한 작업을 수행하는 필터 2개를 보여줍니다. 그러나 첫 번째 예에서 CPU가 더 많이 사
용됩니다. 두 번째 필터에서는 더욱 효율적인 정규식을 사용합니다.

이 예에서 AsyncOS는 각 첨부 파일 유형 및 recv-listener에 대해 한 번씩, 정규식 엔진을 30번 시작
해야 합니다.

대신, 다음과 같이 필터를 작성합니다.

정규식 엔진은 두 번만 시작하면 되고 필터는 유지 관리하기 쉽기 때문에 "()" 추가나 철자 오류에 
대해 걱정할 필요가 없습니다. 위의 예에서와 달리, 이 정규식은 CPU 오버헤드 감소를 보여줍니다.

PDF 및 정규식

PDF가 생성되는 방법에 따라 공백이나 줄 바꿈이 없을 수 있습니다. 이 경우, 검사 엔진은 페이지
의 단어 위치에 따라 논리적 공간 및 줄 바꿈 삽입을 시도합니다. 예를 들어, 단어가 여러 글꼴 또는 
글꼴 크기로 구성된 경우 PDF 코드는 검사 엔진이 단어 및 줄 바꿈을 확인하기 어려운 방식으로 렌
더링됩니다. 이러한 방식으로 구성된 PDF 파일과 달리 정규식을 일치시키려고 시도하는 경우 검
사 엔진에서 예기치 않은 결과를 반환할 수 있습니다. 

attachment-filter: if ((recv-listener == "Inbound") AND 

((((((((((((((((((((((((((((((((((((((((((((((attachment-filename ==

"\\.386$") OR (attachment-filename == "\\.exe$")) OR (attachment-filename == "\\.ad$")) 

OR (attachment-filename == "\\.ade$")) OR (attachment-filename == "\\.adp$")) OR 

(attachment-filename == "\\.asp$")) OR (attachment-filename == "\\.bas$")) OR 

(attachment-filename == "\\.bat$")) OR (attachment-filename == "\\.chm$")) OR 

(attachment-filename == "\\.cmd$")) OR (attachment-filename == "\\.com$")) OR 

(attachment-filename == "\\.cpl$")) OR (attachment-filename == "\\.crt$")) OR 

(attachment-filename == "\\.exe$")) OR (attachment-filename == "\\.hlp$")) OR 

(attachment-filename == "\\.hta$")) OR (attachment-filename == "\\.inf$")) OR 

(attachment-filename == "\\.ins$")) OR (attachment- filename == "\\.isp$")) OR 

(attachment-filename == "\\.js$")) OR (attachment-filename == "\\.jse$")) OR 

(attachment- filename == "\\.lnk$")) OR (attachment-filename == "\\.mdb$")) OR 

(attachment-filename == "\\.mde$")) OR (attachment-filename == "\\.msc$")) OR 

(attachment-filename == "\\.msi$")) OR (attachment-filename == "\\.msp$")) OR 

(attachment-filename == "\\.mst$")) OR (attachment-filename == "\\.pcd$")) OR 

(attachment-filename == "\\.pif$")) OR (attachment-filename == "\\.reg$")) OR 

(attachment-filename == "\\.scr$")) OR (attachment-filename == "\\.sct$")) OR 

(attachment-filename == "\\.shb$")) OR (attachment-filename == "\\.shs$")) OR 

(attachment-filename == "\\.url$")) OR (attachment-filename == "\\.vb$")) OR 

(attachment-filename == "\\.vbe$")) OR (attachment-filename == "\\.vbs$")) OR 

(attachment-filename == "\\.vss$")) OR (attachment-filename == "\\.vst$")) OR 

(attachment-filename == "\\.vsw$")) OR (attachment-filename == "\\.ws$")) OR 

(attachment-filename == "\\.wsc$")) OR (attachment-filename == "\\.wsf$")) OR 

(attachment-filename == "\\.wsh$"))) { bounce(); }

attachment-filter: if (recv-listener == "Inbound") AND (attachment-filename == 

"\\.(386|exe|ad|ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|jse|l

nk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shb|shs|url|vb|vbe|vbs|vss|vst|vsw|ws|wsc

|wsf|wsh)$") {

    bounce();

  }