Cisco Cisco Email Security Appliance C160 Guía Del Usuario
6-11
Cisco IronPort AsyncOS 7.5 for Email Advanced Configuration Guide
OL-25137-01
Chapter 6 Using Message Filters to Enforce Email Policies
The
body-contains
filter rule would determine the score for this message by first
scoring the text/plain and text/html parts of the message. It would then compare
the results of these scores and select the highest score from the results. Next, it
would add this result to the score from each of the attachments to determine the
final score. Suppose the message has the following number of matches:
the results of these scores and select the highest score from the results. Next, it
would add this result to the score from each of the attachments to determine the
final score. Suppose the message has the following number of matches:
Because AsyncOS compares the matches for the text/plain and text/html parts, it
returns a score of 3, which does not meet the minimum threshold to trigger the
filter rule.
returns a score of 3, which does not meet the minimum threshold to trigger the
filter rule.
Threshold Scoring for Content Dictionaries
When you use a content dictionary, you can “weight” terms so that certain terms
trigger filter actions more easily. For example, you may want not want to trigger
a message filter for the term, “bank.” However, if the term, “bank” is combined
with the term, “account,” and accompanied with an ABA routing number, you
may want to trigger a filter action. To accomplish this, you can use a weighted
dictionary to give increased importance to certain terms or a combination of
trigger filter actions more easily. For example, you may want not want to trigger
a message filter for the term, “bank.” However, if the term, “bank” is combined
with the term, “account,” and accompanied with an ABA routing number, you
may want to trigger a filter action. To accomplish this, you can use a weighted
dictionary to give increased importance to certain terms or a combination of
application/octet-stream
application/octet-stream
multipart/mixed
multipart/alternative
text/plain (2 matches)
text/html (2 matches)
application/octet-stream (1 match)
application/octet-stream