Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
9-47
Cisco AsyncOS 9.0 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
In the following example, at any given point in time, if the filter detects
X
or more outgoing messages
from same envelope sender in the last one hour, the subsequent messages from the same envelope sender
are dropped and discarded.
are dropped and discarded.
In the following example, at any given point in time, if the filter detects
X
or more incoming or outgoing
messages with identical subject in the last one hour, the administrator is notified for every subsequent
message with identical subject.
message with identical subject.
URL Reputation Rules
Use a URL reputation rule to define message actions based on the reputation score of any URL in the
message. For important details, see
message. For important details, see
in
For these rules:
•
msg_filter_name
: is the name of this message filter.
•
whitelist
is the name of a defined URL list (via the
urllistconfig
command.) Specifying a
whitelist is optional.
To take action when the reputation service provides a score:
Use the
url-reputation
rule.
Filter syntax when using a
url-reputation
rule is:
<msg_filter_name>:
if url-reputation(<min_score>, <max_score>, '<whitelist>')
{<action>}
Where:
•
min_score
and
max_score
are the minimum and maximum scores in the range for which the action
should apply. The values that you specify are included in the range.
Minimum and maximum scores must be between
-10.0
and
10.0
.
To take action when the reputation service does not provide a score:
Use the
url-no-reputation
rule.
Filter syntax when using a
url-no-reputation
rule is:
<msg_filter_name>:
if url_no_reputation('<whitelist>')
{<action>}
URL Category Rule
Use URL categories to define message actions based on the category of URLs in the message. For
important details, see
important details, see
in
f2 : if header-repeats('mail-from', X, 'outgoing') {drop();}
f3: if header-repeats('subject', X) {notify('admin@xyz.com');}