Cisco Cisco Email Security Appliance C160 Mode D'Emploi

the number of matches it finds in the message and attachments. If the minimum 
threshold is not met, the regular expression does not evaluate to true. You can 
specify this threshold for the following filter rules:

body-contains

only-body-contains

attachment-contains

every-attachment-contains

dictionary-match

attachment-dictionary-match

You can also specify a threshold value for the 

drop-attachments-where-contains

 action.

You cannot specify thresholds for filter rules that scan headers or envelope 
recipients and senders.

To specify a threshold for the minimum number of occurrences, specify the 
pattern and the minimum number of matches required to evaluate to true: 

For example, to specify that the 

body-contains

 filter rule must find the value 

“Company Confidential” at least two times, use the following syntax:

By defeat, when AsyncOS saves a content scanning filter, it compiles the filter and 
assigns a threshold value of 1, if you have not assigned a value. 

You can also specify a minimum number of pattern matches for values in a content 
dictionary. For more information about content dictionaries, see the “Text 
Resources” chapter in the Cisco IronPort AsyncOS for Email Configuration 
Guide.

if(<filter rule>('<pattern>',<minimum threshold>)){

if(body-contains('Company Confidential',2)){