Cisco Cisco Email Security Appliance C160 Mode D'Emploi

attachment-filetype

Does the message contain an attachment of a file 
type that matches a specific pattern based on its 
fingerprint (similar to a UNIX 

file

 command)? 

If the attachment is an Excel or Word document, 
you can also search for the following embedded 
file types: .exe , .dll, .bmp, .tiff, .pcx, .gif, .jpeg, 
png, and Photoshop images.

You must enclose the file type in quotes to create 
a valid filter. You can use single or double 
quotes. For example, to search for .exe 
attachments, use the following syntax: 

if (attachment-filetype == "exe")

For more information, see 

attachment-mimetype

Does the message contain an attachment of a 
specific MIME type? This rule is similar to the 

attachment-type

 rule, except only the MIME 

type given by the MIME attachment is evaluated. 
(The appliance does not try to “guess” the type 
of the file by its extension if there is no explicit 
type given.) See 

attachment-protected

Does the message contain an attachment that is 
password protected? See 

attachment-unprotected

The attachment-unprotected filter condition 
returns true if the scanning engine detects an 
attachment that is unprotected. A file is 
considered unprotected if the scanning engine 
was able to read the attachment. A zip file is 
considered to be unprotected if any of its 
members is unprotected. 

Note — The attachment-unprotected filter 
condition is not mutually exclusive of the 
attachment-protected filter condition. It is 
possible for both filter conditions to return true 
when scanning the same attachment. This can 
occur, for example, if a zip file contains both 
protected and unprotected members.

See