Cisco Cisco Email Security Appliance C190 Guía Del Usuario
11-10
Cisco AsyncOS 9.1 for Email User Guide
Chapter 11 Content Filters
How Content Filters Work
Only one final action may be defined per filter, and the final action must be last action listed. Bounce,
deliver, and drop are final actions. When entering actions for content filters, the GUI and CLI will force
final actions to be placed last.
deliver, and drop are final actions. When entering actions for content filters, the GUI and CLI will force
final actions to be placed last.
Table 11-2
Content Filter Actions
Action
Description
Quarantine
Quarantine. Flags the message to be held in one of the policy quarantine
areas.
areas.
Duplicate message: Sends a copy of the message to the specified quarantine
and continues processing the original message. Any additional actions apply
to the original message.
and continues processing the original message. Any additional actions apply
to the original message.
Encrypt on Delivery
The message continues to the next stage of processing. When all processing
is complete, the message is encrypted and delivered.
is complete, the message is encrypted and delivered.
Encryption rule: Always encrypts the message or only encrypts it if an
attempt to send it over a TLS connection first fails. See
attempt to send it over a TLS connection first fails. See
for more information.
Encryption Profile. Once processing is complete, encrypts the message
using the specified encryption profile, then delivers the message. This action
is for use with a Cisco Encryption Appliance or a hosted key service.
using the specified encryption profile, then delivers the message. This action
is for use with a Cisco Encryption Appliance or a hosted key service.
Subject. Subject for the encrypted message. By default, the value is
$Subject
.
Strip Attachment by
Content
Content
Attachment contains. Drops all attachments on messages that contain the
regular expression. Archive files (zip, tar) will be dropped if any of the files
they contain match the regular expression pattern.
regular expression. Archive files (zip, tar) will be dropped if any of the files
they contain match the regular expression pattern.
Contains smart identifier. Drops all attachments on a message that contains
the specified smart identifier.
the specified smart identifier.
Attachment contains terms in the content dictionary. Does the
attachment contain any of the regular expressions or terms in the content
dictionary named <dictionary name>?
attachment contain any of the regular expressions or terms in the content
dictionary named <dictionary name>?
Number of matches required. Specify the number of matches required for
the rule to evaluate to true. You can specify this threshold for text, smart
identifier, or content dictionary matches.
the rule to evaluate to true. You can specify this threshold for text, smart
identifier, or content dictionary matches.
Replacement message. The optional comment serves as the means to
modify the text used to replace the attachment that was dropped. Attachment
footers simply append to the message.
modify the text used to replace the attachment that was dropped. Attachment
footers simply append to the message.