Cisco Cisco Email Security Appliance C160 Mode D'Emploi

part) as opposed to the “body” of the message (the first, plain text part) — 
although, according to the language used in RFCSs 1521 and 1522, a message’s 
body is comprised of all MIME parts. 

Because the Cisco IronPort appliance makes this distinction between the body and 
the attachment in multipart messages, there are several cases you should be aware 
of when using the 

body-

variable or 

attachment-

variable message filter rules in 

order to achieve the expected behavior:

If you have a message with a single text part—that is, a message containing 
a header of “Content-Type: text/plain” or “Content-Type: text/html” — the 
Cisco IronPort appliance will consider the entire message as the body. If the 
content type is anything different, the Cisco IronPort appliance considers it 
to be a single attachment.

Some encoded files (uuencoded, for example) are included in the body of the 
email message. When this occurs, the encoded file is treated as an attachment, 
and it is extracted and scanned, while the remaining text is considered to be 
the body of the text. 

A single, non-text part is always considered an attachment. For example, a 
message consisting of only a.zip file is considered an attachment.

When you add filter rules that search for patterns in the message body or 
attachments, you can specify the minimum threshold for the number of times the 
pattern must be found. When AsyncOS scans the message, it totals the “score” for