Cisco Cisco Email Security Appliance X1070 User Guide
6-45
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
OL-25137-01
Chapter 6 Using Message Filters to Enforce Email Policies
Attachment Groups
You can specify a particular file type (“exe” files for example) or common groups of attachments in the
attachment-filetype
and
drop-attachments-by-filetype rules
. AsyncOS divides the attachments
into the groups listed in
If you create a message filter that uses the
!=
operator to match a message that does not contain an
attachment with a specific file type, the filter will not perform any action on the message if there is at
least one attachment with the file type you want to filter out. For example, the following filter drops any
message with an attachment that is not an
least one attachment with the file type you want to filter out. For example, the following filter drops any
message with an attachment that is not an
.exe
file type:
Add Footer
add-footer(footer-nam
e)
Add a footer to the message. See “Message Disclaimer
Stamping” in the “Text Resources” chapter in the Cisco
IronPort AsyncOS for Email Configuration Guide for
more information.
Stamping” in the “Text Resources” chapter in the Cisco
IronPort AsyncOS for Email Configuration Guide for
more information.
Encrypt on
Delivery
Delivery
encrypt-deferred
Encrypt message on delivery, which means that the
message continues to the next stage of processing, and
when all processing is complete, the message is encrypted
and delivered.
message continues to the next stage of processing, and
when all processing is complete, the message is encrypted
and delivered.
Add Message Tag
tag-message(tag-name)
Add a custom term into the message to use with RSA
Email DLP policy filtering. You can configure a RSA
Email DLP policy to limit scanning to messages with the
message tag. The message tag is not visible to recipients.
See
Email DLP policy filtering. You can configure a RSA
Email DLP policy to limit scanning to messages with the
message tag. The message tag is not visible to recipients.
See
and the “Data
Loss Prevention” chapter in the Cisco IronPort AsyncOS
for Email Configuration Guide.
for Email Configuration Guide.
Add Log Entry
log-entry
Adds customized text into the IronPort Text Mail logs at
the
the
INFO
level. The text can include action variables. The
*Skip Remaining
Message Filters
Message Filters
skip-filters
Ensure that this message is not processed by any other
message filters and continues through the email pipeline.
See
message filters and continues through the email pipeline.
See
*Drop message
drop
Drop and discard the message. See
.
*Bounce message
bounce
Send the message back to the sender. See
.
*Encrypt and
Deliver Now
Deliver Now
encrypt
Use Cisco IronPort Email Encryption to encrypt outgoing
messages. See
messages. See
* Final Actions
Table 6-5
Message Filter Actions
Action Syntax
Description
exe_check: if (attachment-filetype != "exe") {
drop();
}