Cisco Cisco Email Security Appliance C650 Guía Del Usuario
Chapter 6 Using Message Filters to Enforce Email Policies
6-338
Cisco IronPort AsyncOS 7.3 for Email Advanced Configuration Guide
OL-23081-01
Body Scanning
When AsyncOS performs body scanning, it scans the body text and attachments
for the regular expression. You can assign a minimum threshold value for the
expression, and if the scanning engine encounters the regular expression the
minimum number of times, the expression evaluates to
for the regular expression. You can assign a minimum threshold value for the
expression, and if the scanning engine encounters the regular expression the
minimum number of times, the expression evaluates to
true
.
AsyncOS evaluates the different MIME parts of the message, and it scans any
MIME part that is textual. AsyncOS identifies the text parts if the MIME type
specifies text in the first part. AsyncOS determines the encoding based on the
encoding specified in the message, and it converts the text to Unicode. It then
searches for the regular expression in Unicode space. If no encoding is specified
in the message, AsyncOS uses the encoding you specify in the
MIME part that is textual. AsyncOS identifies the text parts if the MIME type
specifies text in the first part. AsyncOS determines the encoding based on the
encoding specified in the message, and it converts the text to Unicode. It then
searches for the regular expression in Unicode space. If no encoding is specified
in the message, AsyncOS uses the encoding you specify in the
scanconfig
command.
For more information about how AsyncOS evaluates MIME parts when scanning
messages, see
messages, see
.
If the MIME part is not textual, AsyncOS extract files from a .zip or .tar archive
or decompresses compressed files. After extracting the data, a scanning engine
identifies the encoding for the file and returns the data from the file in Unicode.
AsyncOS then searches for the regular expression in Unicode space.
or decompresses compressed files. After extracting the data, a scanning engine
identifies the encoding for the file and returns the data from the file in Unicode.
AsyncOS then searches for the regular expression in Unicode space.
The following example searches the body text and attachment for the phrase
“Company Confidential.” The example specifies a minimum threshold of two
instances, so if the scanning engine finds two or more instances of the phrase, it
bounces any matching messages, and notifies the legal department of the attempt:
“Company Confidential.” The example specifies a minimum threshold of two
instances, so if the scanning engine finds two or more instances of the phrase, it
bounces any matching messages, and notifies the legal department of the attempt:
ConfidentialFilter:
if (body-contains('Company Confidential',2)) {
notify ('legaldept@example.domain');
bounce();
}