Cisco Cisco Email Security Appliance X1050 Guía Del Usuario
Chapter 5 Using Message Filters to Enforce Email Policies
5-356
Cisco IronPort AsyncOS 7.1 for Email Advanced Configuration Guide
OL-22164-02
You can also use the $MatchedContent action variable to notify senders or
administrators that a content filter was triggered. The $MatchedContent action
variable displays the content that triggered the filter. For example, the following
filter sends a notification to an administrator if the email contains ABA account
information.
administrators that a content filter was triggered. The $MatchedContent action
variable displays the content that triggered the filter. For example, the following
filter sends a notification to an administrator if the email contains ABA account
information.
ABA_filter:
if (body-contains ('*aba')){
notify('admin@example.com','[$MatchedContent]Account Information
Displayed');
}
Notification Template
You can use the Text Resources page or the
textconfig
CLI command to
configure custom notification templates as text resources for use with the
notify()
and
notify-copy()
actions. If you do not create a custom notification
template, a default template is used. The default template includes message
headers, but the custom notification template does not include message headers
by default. To include message headers in the custom notification, include the
headers, but the custom notification template does not include message headers
by default. To include message headers in the custom notification, include the
$AllHeaders
action variable.
For more information, see the “Text Resources” chapter in the Cisco IronPort
AsyncOS for Email Configuration Guide.
AsyncOS for Email Configuration Guide.
in the following example, when a large message triggers the filter shown below,
an email is sent to the intended recipients explaining that the message was too
large:
an email is sent to the intended recipients explaining that the message was too
large:
bigFilter:
if (body-size >= 4M)
{
notify('$EnvelopeRecipients', '[$FilterName] Message too large',
'$EnvelopeFrom', 'message.too.large');