Cisco Cisco Email Security Appliance C160 Mode D'Emploi
9-82
Cisco AsyncOS 8.5.6 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Attachment Scanning
For example, the following mail log shows attachments dropped by message filter rules as a result of
Image Analysis scanning:
Image Analysis scanning:
Configuring the Message Filter to Perform Actions Based on Image Analysis
Results
Results
Once you enable image analysis, you must create a message filter to perform different actions for
different message verdicts. For example, you may wish to deliver messages with a clean verdict, but
quarantine messages that are determined to have inappropriate content.
different message verdicts. For example, you may wish to deliver messages with a clean verdict, but
quarantine messages that are determined to have inappropriate content.
Note
Cisco recommends you do not drop or bounce messages with inappropriate or suspect verdicts. Instead,
send copies of violations to a quarantine for later review and better understanding of trend analysis.
send copies of violations to a quarantine for later review and better understanding of trend analysis.
The following filter shows messages tagged if the content is inappropriate or suspect:
Related Topics
•
Thu Apr 3 08:17:56 2009 Debug: MID 154 IronPort Image Analysis: image 'Unscannable.jpg'
is unscannable.
Thu Apr 3 08:17:56 2009 Info: MID 154 IronPort Image Analysis: attachment
'Unscannable.jpg' score 0 unscannable
Thu Apr 3 08:17:56 2009 Info: MID 6 rewritten to MID 7 by
drop-attachments-where-image-verdict filter 'f-001'
Thu Apr 3 08:17:56 2009 Info: Message finished MID 6 done
image_analysis: if image-verdict == "inappropriate" {
strip-header("Subject");
insert-header("Subject", "[inappropriate image] $Subject");
}
else {
if image-verdict == "suspect" {
strip-header("Subject");
insert-header("Subject", "[suspect image] $Subject");
}
}