Cisco Cisco Email Security Appliance C680 User Guide

This filter scans and blind copies messages that are sent to competitors. Note that you could use a 
dictionary and the header-dictionary-match() rule to specify a more flexible list of competitors (see 

Use this filter to block email from a specific address:

Log and drop only the messages that have matching filetypes:

Find messages with very large “To” headers. 

competitorFilter:

if (rcpt-to == '@competitor1.com|@competitor2.com') {

    bcc-scan('legal@example.com');

}

block_harrasing_user:

if (mail-from == "ex-employee@hotmail\\.com") {

    notify ("admin@company.com");

    drop ();

} 

drop_attachments: 

if (mail-from != "user@example.com") AND (attachment-filename ==

'(?i)\\.(asp|bas|bat|cmd|cpl|exe|hta|ins|isp|js)$')

{

  archive("Drop_Attachments");

  insert-header("X-Filter", "Dropped by: $FilterName MID: $MID"); 

drop-attachments-by-name("\\.(asp|bas|bat|cmd|cpl|exe|hta|ins|isp|js)$");

}