Cisco Cisco Email Security Appliance C160 Mode D'Emploi
9-67
Cisco AsyncOS 8.0.2 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Attachment Scanning
Image Analysis
Some messages contain images that you may wish to scan for inappropriate content. You can use the
image analysis engine to search for inappropriate content in email. Image analysis is not designed to
supplement or replace your anti-virus and anti-spam scanning engines. Its purpose is to enforce
acceptable use by identifying inappropriate content in email. Use the image analysis scanning engine to
quarantine and analyze mail and to detect trends.
image analysis engine to search for inappropriate content in email. Image analysis is not designed to
supplement or replace your anti-virus and anti-spam scanning engines. Its purpose is to enforce
acceptable use by identifying inappropriate content in email. Use the image analysis scanning engine to
quarantine and analyze mail and to detect trends.
After you configure AsyncOS for image analysis, you can use image analysis filter rules to perform
actions on suspect or inappropriate emails. Image scanning allows you to scan the following types of
attached files: JPEG, BMP, PNG, TIFF, GIF, TGA, ICO, and PCX. The image analyzer uses algorithms
that measure skin color, body size and curvature to determine the probability that the graphic contains
inappropriate content. When you scan image attachments, Cisco fingerprinting determines the file type,
and the image analyzer uses algorithms to analyze the image content. If the image is embedded in
another file, the Stellent scanning engine extracts the file. The Stellent scanning engine can extract
images from many file types, including Word, Excel, and PowerPoint documents. The image analysis
verdict is computed on the message as a whole. If the message does not include any images, the message
receives a score of “0” which maps to a “clean” verdict. Therefore, a message without any images will
receive a "clean" verdict.
actions on suspect or inappropriate emails. Image scanning allows you to scan the following types of
attached files: JPEG, BMP, PNG, TIFF, GIF, TGA, ICO, and PCX. The image analyzer uses algorithms
that measure skin color, body size and curvature to determine the probability that the graphic contains
inappropriate content. When you scan image attachments, Cisco fingerprinting determines the file type,
and the image analyzer uses algorithms to analyze the image content. If the image is embedded in
another file, the Stellent scanning engine extracts the file. The Stellent scanning engine can extract
images from many file types, including Word, Excel, and PowerPoint documents. The image analysis
verdict is computed on the message as a whole. If the message does not include any images, the message
receives a score of “0” which maps to a “clean” verdict. Therefore, a message without any images will
receive a "clean" verdict.
Note
Images cannot be extracted from PDF files.
Configuring the Image Analysis Scanning Engine
To enable image analysis from the GUI:
Procedure
Step 1
Go to Security Services > IronPort Image Analysis.
Step 2
Click Enable.
A success message displays, and the verdict settings display.
Figure 9-3
Cisco Image Analysis Overview
The image analysis filter rule allows you to determine the actions to take based on the following verdicts:
•
Clean: The image is free of inappropriate content. The image analysis verdict is computed on the
message as a whole, so a message without any images will receive a "clean" verdict if scanned.
message as a whole, so a message without any images will receive a "clean" verdict if scanned.
•
Suspect: The image may contain inappropriate content.
•
Inappropriate: The image contains inappropriate content.
These verdicts represent a numeric value assigned by the image analyzer algorithm to determine
probability of inappropriate content.
probability of inappropriate content.