Cisco Cisco Email Security Appliance X1070 Mode D'Emploi
11-6
Cisco AsyncOS 9.5 for Email User Guide
Chapter 11 Content Filters
How Content Filters Work
Attachment File Info
Filename. Does the message have an attachment with a filename that
matches a specific pattern?
matches a specific pattern?
Filename contains term in content dictionary. Does the message have an
attachment with a filename that contains any of the regular expressions or
terms in the content dictionary named <dictionary name>?
attachment with a filename that contains any of the regular expressions or
terms in the content dictionary named <dictionary name>?
For this option to be enabled, the dictionary must already have been
created. See
created. See
.
Note
The dictionary-related conditions are only available if you have
one or more dictionaries enabled. For information about creating
content dictionaries, see
one or more dictionaries enabled. For information about creating
content dictionaries, see
File type. Does the message have an attachment of a file type that matches
a specific pattern based on its fingerprint (similar to a UNIX
a specific pattern based on its fingerprint (similar to a UNIX
file
command)?
MIME type. Does the message have an attachment of a specific MIME
type? This rule is similar to the
type? This rule is similar to the
attachment-type
rule, except only the
MIME type given by the MIME attachment is evaluated. (The appliance
does not try to “guess” the type of the file by its extension if there is no
explicit type given.)
does not try to “guess” the type of the file by its extension if there is no
explicit type given.)
Image Analysis. Does the message have an image attachment that matches
the image verdict specified? Valid image analysis verdicts include:
Suspect, Inappropriate, Suspect or Inappropriate, Unscannable, or Clean.
the image verdict specified? Valid image analysis verdicts include:
Suspect, Inappropriate, Suspect or Inappropriate, Unscannable, or Clean.
Attachment is Corrupt. Does this message have an attachment that is
corrupt?
corrupt?
Note
A corrupt attachment is an attachment that the scanning engine
cannot scan and identified as corrupt.
cannot scan and identified as corrupt.
Attachment Protection
Contains an attachment that is password-protected or encrypted.
(For example, use this condition to identify attachments that are potentially
unscannable.)
unscannable.)
Contains an attachment that is NOT password-protected or encrypted.
Table 11-1
Content Filter Conditions (continued)
Condition
Description