Cisco Cisco Email Security Appliance C190 Guía Del Usuario
9-9
Cisco AsyncOS 8.0.1 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
In a somewhat more complicated example, consider:
The system groups the expression from left to right, so this becomes:
This means the first thing the system does is compare the cost of
(test1 AND test2)
against the cost of
test3
, evaluating the second AND first. If all three tests have the same cost, then
test3
will be
performed first because
(test1 AND test2)
would be twice as expensive.
Message Filter Rules
Each message filter contains a rule that defines the collection of messages that a filter can act upon. You
define the filter rules, and then you define a filter action for messages that return
define the filter rules, and then you define a filter action for messages that return
true
.
Filter Rules Summary Table
summarizes the rules you can use in message filters.
if (test1 AND test2 AND test3) { ... }
if ((test1 AND test2) AND test3) { ... }
Table 9-2
Message Filter Rules
Rule Syntax
Description
Subject Header
subject
Does the subject header match a certain pattern?
See
See
Body Size
body-size
Is the body size within some range? See
Envelope Sender
mail-from
Does the Envelope Sender (i.e., the Envelope
From, <MAIL FROM>) match a given pattern?
See
From, <MAIL FROM>) match a given pattern?
See
Envelope Sender in
Group
Group
mail-from-group
Is the Envelope Sender (i.e., the Envelope From,
<MAIL FROM>) in a given LDAP group? See
<MAIL FROM>) in a given LDAP group? See
Sender Group
sendergroup
Which sender group was matched in a listener's
Host Access Table (HAT)? See
Host Access Table (HAT)? See
.
Envelope Recipient
rcpt-to
Does the Envelope Recipient, (i.e. the Envelope
To, <RCPT TO>) match a given pattern? See
To, <RCPT TO>) match a given pattern? See
.
Note: The
rcpt-to
rule is message-based. If a
message has multiple recipients, only one
recipient has to match the rule for the specified
action to affect the message to all recipients.
recipient has to match the rule for the specified
action to affect the message to all recipients.