Cisco Cisco Email Security Appliance X1070 Mode D'Emploi

Filename. Does the message have an attachment with a filename that 
matches a specific pattern?

Filename contains term in content dictionary. Does the message have an 
attachment with a filename that contains any of the regular expressions or 
terms in the content dictionary named <dictionary name>?

For this option to be enabled, the dictionary must already have been 
created. See 

.

The dictionary-related conditions are only available if you have 
one or more dictionaries enabled. For information about creating 
content dictionaries, see 

File type. Does the message have an attachment of a file type that matches 
a specific pattern based on its fingerprint (similar to a UNIX 

file

 

command)? 

MIME type. Does the message have an attachment of a specific MIME 
type? This rule is similar to the 

attachment-type

 rule, except only the 

MIME type given by the MIME attachment is evaluated. (The appliance 
does not try to “guess” the type of the file by its extension if there is no 
explicit type given.) 

Image Analysis. Does the message have an image attachment that matches 
the image verdict specified? Valid image analysis verdicts include: 
Suspect, Inappropriate, Suspect or Inappropriate, Unscannable, or Clean. 

Attachment is Corrupt. Does this message have an attachment that is 
corrupt? 

A corrupt attachment is an attachment that the scanning engine 
cannot scan and identified as corrupt. 

(For example, use this condition to identify attachments that are potentially 
unscannable.)