Cisco Cisco Email Security Appliance C170 Guía Del Usuario
9-36
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
The following example sends the message to the Policy quarantine if the message body contains any
words within the dictionary named “secret_words.” Unlike the
words within the dictionary named “secret_words.” Unlike the
only-body-contains
condition, the
body-dictionary-match
condition does not require that all the content parts individually match the
dictionary. The scores of each content part (taking into account multipart/alternative parts) are added
together.
together.
In the following filter, a subject that matches a term in the specified dictionary is quarantined:
This example matches an email address in the “to” header and blind copies an administrator:
The
attachment
-
dictionary-match(<dictonary_name>)
rule works like the
dictionary-match
rule
above, except that it looks for matches in the attachment.
The following filter sends the message to the Policy quarantine if the message attachment contains any
words found within the dictionary named “secret_words.”
words found within the dictionary named “secret_words.”
quarantine_data_loss_prevention:
if (body-dictionary-match ('secret_words'))
{
quarantine('Policy');
}
quarantine_policy_subject:
if (subject-dictionary-match ('gTest'))
{
quarantine('Policy');
}
headerTest:
if (header-dictionary-match ('competitorsList', 'to'))
{
bcc('administrator@example.com');
}
quarantine_codenames_attachment:
if (attachment-dictionary-match ('secret_words'))
{