Cisco Cisco Email Security Appliance C160 Guía Del Usuario
9-11
Cisco AsyncOS 8.5.6 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Envelope Recipient
in Group
rcpt-to-group
Is the Envelope Recipient, (i.e. the Envelope To,
<RCPT TO>) in a given LDAP group? See
<RCPT TO>) in a given LDAP group? See
Note: The
rcpt-to-group
rule is
message-based. If a message has multiple
recipients, only one recipient has to be found in
a group for the specified action to affect the
message to all recipients.
recipients, only one recipient has to be found in
a group for the specified action to affect the
message to all recipients.
Remote IP
remote-ip
Was the message sent from a remote host that
matches a given IP address or IP block? See
matches a given IP address or IP block? See
Receiving
Interface
Interface
recv-int
Did the message arrive via the named receiving
interface? See
interface? See
Receiving Listener
recv-listener
Did the message arrive via the named listener?
See
See
Date
date
Is current time before or after a specific time and
date? See
date? See
Header
header(<string>)
Does the message contain a specific header?
Does the value of that header match a certain
pattern? See
Does the value of that header match a certain
pattern? See
.
Random
random(<integer>)
Is a random number in some range? See
.
Recipient Count
rcpt-count
How many recipients is this email going to? See
Address Count
addr-count()
What is the cumulative number of recipients?
This filter differs from the rcpt-count filter rule
in that it operates on the message body headers
instead of the envelope recipients. See
in that it operates on the message body headers
instead of the envelope recipients. See
SPF Status
spf-status
What was the SPF verification status? This filter
rule allows you to query for different SPF
verification results. You can enter a different
action for each valid SPF/SIDF return value. See
rule allows you to query for different SPF
verification results. You can enter a different
action for each valid SPF/SIDF return value. See
.
SPF Passed
spf-passed
Did the SPF/SIDF verification pass? This filter
rule generalizes the SPF/SIDF results as a
Boolean value. See
rule generalizes the SPF/SIDF results as a
Boolean value. See
.
Image verdict
image-verdict
What was the image scanning verdict? This filter
rule allows you to query for different image
analysis verdicts. See
rule allows you to query for different image
analysis verdicts. See
Table 9-2
Message Filter Rules
Rule Syntax
Description