Cisco Cisco Email Security Appliance C160 Mode D'Emploi

This filter sends notification based on whether the subject contains specific words:

This filter scans and blind copies messages that are sent to competitors. Note that you could use a 
dictionary and the header-dictionary-match() rule to specify a more flexible list of competitors (see 

Use this filter to block email from a specific address:

Log and drop only the messages that have matching filetypes:

search_for_sensitive_content:

if (Subject == "(?i)plaintiff|lawsuit|judge" ) {

    notify ("admin@company.com");

}

competitorFilter:

if (rcpt-to == '@competitor1.com|@competitor2.com') {

    bcc-scan('legal@example.com');

}

block_harrasing_user:

if (mail-from == "ex-employee@hotmail\\.com") {

    notify ("admin@company.com");

    drop ();

} 

drop_attachments: 

if (mail-from != "user@example.com") AND (attachment-filename ==

'(?i)\\.(asp|bas|bat|cmd|cpl|exe|hta|ins|isp|js)$')