Cisco Cisco Email Security Appliance C190 Guía Del Usuario
Chapter 5 Using Message Filters to Enforce Email Policies
5-326
Cisco IronPort AsyncOS 7.1 for Email Advanced Configuration Guide
OL-22164-02
The
attachment
-
dictionary-match(<dictonary_name>)
rule works like the
dictionary-match
rule above, except that it looks for matches in the attachment.
The following filter sends the message to the Policy quarantine if the message
attachment contains any words found within the dictionary named
“secret_words.”
attachment contains any words found within the dictionary named
“secret_words.”
quarantine_codenames_attachment:
if (attachment-dictionary-match ('secret_words'))
{
quarantine('Policy');
}
The
header
-
dictionary-match(<dictonary_name>, <header>)
rule works like
the dictionary-match rule above, except that it looks for matches in the header
specified in <header>. The header name is case insensitive, so, for example,
“subject” and “Subject” both work.
specified in <header>. The header name is case insensitive, so, for example,
“subject” and “Subject” both work.
The following filter sends the message to the Policy quarantine if the message’s
“cc” header contains any words found within the dictionary named
“ex_employees.”
“cc” header contains any words found within the dictionary named
“ex_employees.”
quarantine_codenames_attachment:
if (header-dictionary-match ('ex_employees', 'cc'))
{
quarantine('Policy');
}
You can use wild cards within the dictionary terms. You do not have to escape the
period in email addresses.
period in email addresses.