Cisco Cisco Email Security Appliance X1070 Guía Del Usuario
11-15
Cisco AsyncOS 8.0.2 for Email User Guide
Chapter 11 Content Filters
Filtering Messages Based on Content
Filtering Messages Based on Content
Creating a Content Filter
Before You Begin
•
If you want to encrypt a message that matches the content filter, create an encryption profile.
•
If you want to add a disclaimer to a matching message, create a disclaimer template to use for
generating disclaimers.
generating disclaimers.
Matched Content
$MatchedContent
Replaced by the value (or values) that
triggered a content-scanning filter. Matched
content can be a content dictionary match, a
smart identifier, or a match to a regular
expression.
triggered a content-scanning filter. Matched
content can be a content dictionary match, a
smart identifier, or a match to a regular
expression.
Header
$Header['string']
Replaced by the value of the quoted header,
if the original message contains a matching
header. Note that double quotes may also be
used.
if the original message contains a matching
header. Note that double quotes may also be
used.
Hostname
$Hostname
Replaced by the hostname of the Cisco
appliance.
appliance.
Internal Message ID
$MID
Replaced by the Message ID, or “MID” used
internally to identify the message. Not to be
confused with the RFC822 “Message-Id”
value (use $Header to retrieve that).
internally to identify the message. Not to be
confused with the RFC822 “Message-Id”
value (use $Header to retrieve that).
Receiving Listener
$RecvListener
Replaced by the nickname of the listener
that received the message.
that received the message.
Receiving Interface
$RecvInt
Replaced by the nickname of the interface
that received the message.
that received the message.
Remote IP Address
$RemoteIP
Replaced by the IP address of the system
that sent the message to the Cisco appliance.
that sent the message to the Cisco appliance.
Remote Host Address
$remotehost
Replaced by the hostname of the system that
sent the message to the Cisco appliance.
sent the message to the Cisco appliance.
SenderBase Reputation
Score
Score
$Reputation
Replaced by the SenderBase Reputation
score of the sender. If there is no reputation
score, it is replaced with “
score of the sender. If there is no reputation
score, it is replaced with “
None
”.
Subject
$Subject
Replaced by the subject of the message.
Time
$Time
Replaced by the current time, in the local
time zone.
time zone.
Timestamp
$Timestamp
Replaced by the current time and date, as
would be found in the Received: line of an
email message, in the local time zone.
would be found in the Received: line of an
email message, in the local time zone.
Table 11-4
Action Variables (continued)
Variable
Syntax
Description