Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
9-4
Cisco AsyncOS 9.0 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Processing
Message Filter Processing
When AsyncOS processes message filters, the content that AsyncOS scans, the order of the processing,
and the actions taken are based on several factors:
and the actions taken are based on several factors:
•
Message filter order. Message filters are maintained in an ordered list. When a message is
processed, AsyncOS applies each message filter in the order it appears in the list. If a final action
occurs, no further action is taken on the message. For more information, see
processed, AsyncOS applies each message filter in the order it appears in the list. If a final action
occurs, no further action is taken on the message. For more information, see
•
Prior processing. Actions performed on AsyncOS messages may add or remove headers before the
message filter is evaluated. AsyncOS processes the message filter process on the headers that are
present in the message at the time of processing. For more information, see
message filter is evaluated. AsyncOS processes the message filter process on the headers that are
present in the message at the time of processing. For more information, see
•
The MIME structure of the message. The MIME structure of the message determines which part
of the message is treated as “body,” and which part of the message is treated as an “attachment”.
Many message filters are configured to act on just the body or just the attachment part of the
message. For more information, see
of the message is treated as “body,” and which part of the message is treated as an “attachment”.
Many message filters are configured to act on just the body or just the attachment part of the
message. For more information, see
.
•
The threshold score configured for the regular expression. When you match a regular expression,
you configure a “score” to tally up the number of times a match must occur before a filter action is
taken. This allows you to “weight” the responses to different terms. For more information, see
you configure a “score” to tally up the number of times a match must occur before a filter action is
taken. This allows you to “weight” the responses to different terms. For more information, see
.
•
The structure of the query. When evaluating AND or OR tests within message filters, AsyncOS
does not evaluate unneeded tests. In addition, it is important to note that the system does not evaluate
the tests from left to right. Instead, when AND and OR tests are evaluated, the least expensive test
is evaluated first. For more information, see
does not evaluate unneeded tests. In addition, it is important to note that the system does not evaluate
the tests from left to right. Instead, when AND and OR tests are evaluated, the least expensive test
is evaluated first. For more information, see
.
Related Topics
•
•
•
•
•
Message Filter Order
Message filters are kept in an ordered list and numbered by their position in the list. When a message is
processed, the message filters are applied in the associated numeric order. Therefore, filter number 30
will not have a chance to alter the source host of a message if filter number 9 has already executed a final
action on (for example, bounced) the message. The position of a filter in the list can be changed via the
system user interfaces. Filters imported via a file are ordered based on their relative order in the imported
file.
processed, the message filters are applied in the associated numeric order. Therefore, filter number 30
will not have a chance to alter the source host of a message if filter number 9 has already executed a final
action on (for example, bounced) the message. The position of a filter in the list can be changed via the
system user interfaces. Filters imported via a file are ordered based on their relative order in the imported
file.
After a final action, no further actions may be taken on the message.
Although a message may match a filter rule, the filter may not act upon that message for any of the
following reasons:
following reasons:
•
The filter is inactive.
•
The filter is invalid.