Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
Chapter 6 Using Message Filters to Enforce Email Policies
6-392
Cisco IronPort AsyncOS 7.3 for Email Advanced Configuration Guide
OL-23081-01
The following example inserts a log entry explaining that message was bounced
because it possibly contained confidential company information:
because it possibly contained confidential company information:
CompanyConfidential:
if (body-contains('Company Confidential'))
{
log-entry('Message may have contained confidential
information.');
bounce();
}
Attachment Scanning
AsyncOS can strip attachments from messages that are inconsistent with your
corporate policies, while still retaining the ability to deliver the original message.
corporate policies, while still retaining the ability to deliver the original message.
You can filter attachments based on their specific file type, fingerprint, or based
on the content of the attachment. Using the fingerprint to determine the exact type
of attachment prevents users from renaming a malicious attachment extension (for
example,
on the content of the attachment. Using the fingerprint to determine the exact type
of attachment prevents users from renaming a malicious attachment extension (for
example,
.exe
) to a more commonly used extension (for example,
.doc
) in the
hope that the renamed file would bypass attachment filters.
When you scan attachments for content, the Stellent attachment scanning engine
extracts data from attachment files to search for the regular expression. It
examines both data and metadata in the attachment file. If you scan an Excel or
Word document, the attachment scanning engine can also detect the following
types of embedded files: .exe, .dll, .bmp, .tiff, .pcx, .gif, .jpeg, .png, and
Photoshop images.
extracts data from attachment files to search for the regular expression. It
examines both data and metadata in the attachment file. If you scan an Excel or
Word document, the attachment scanning engine can also detect the following
types of embedded files: .exe, .dll, .bmp, .tiff, .pcx, .gif, .jpeg, .png, and
Photoshop images.
Message Filters for Scanning Attachments
The message filter actions described in
are non-final actions.
(Attachments are dropped and the message processing continues.)