Cisco Cisco Email Security Appliance C680 User Guide

The Cisco IronPort appliance contains extensive content scanning and message filtering technology that 
allows you to enforce corporate policies and act on specific messages as they enter or leave your 
corporate networks. 

This chapter contains information about the powerful combinations of features available for policy 
enforcement: a content scanning engine, message filters, attachment filters, and content dictionaries. 

This chapter contains the following sections:

Message filters allow you to create special rules describing how to handle messages as they are received 
by the Cisco IronPort appliance. A message filter specifies that a certain kind of email message should 
be given special treatment. Cisco IronPort message filters also allow you to enforce corporate email 
policy by scanning the content of messages for words you specify. This chapter contains the following 
sections:

Components of a message filter. Message filters allow you to create special rules describing how 
to handle messages as they are received. Filter rules identify messages based on message or 
attachment content, information about the network, message envelope, message headers, or message 
body. Filter actions generate notifications or allow messages to be dropped, bounced, archived, blind 
carbon copied, or altered. For more information, see 

Processing Message Filters. When AsyncOS processes message filters, the content that AsyncOS 
scans, the order of the processing, and the actions taken are based on several factors, including the 
message filter order, any prior processing that may have altered the message content, the MIME 
structure of the message, the threshold score configured for content matching, and structure of the 
query. For more information, see