Cisco Cisco Email Security Appliance C160 Mode D'Emploi

The 

addr-count()

 message filter rule takes one or more header strings, counts the 

number of recipients in each line and reports the cumulative number of recipients. 
This filter differs from the

 rcpt-count 

filter rule in that it operates on the 

message body headers instead of the envelope recipients. The following example 
shows the filter rule used to replace a long list of recipients with the alias, 
“undisclosed-recipients”:

The 

body-contains()

 rule scans the incoming email and all its attachments for a 

particular pattern defined by its parameter. This includes delivery-status parts and 
associated attachments. The 

body-contains()

 rule does not perform multi-line 

matching. The scanning logic can be modified using the 

scanconfig

 command in 

the CLI to define which MIME types should or should not be scanned. You can 
also specify a minimum number of matches that the scanning engine must find in 
order for the scan to evaluate to true.

By default, the system scans all attachments except for those with a MIME type 
of 

video/*

, 

audio/*

, 

image/*

. The system scans archive attachments — 

.zip

, 

.bzip

, 

.compress

, 

.tar

,  or 

.gzip

 attachments containing multiple files. You can 

set the number of “nested” archived attachments to scan (for example, a 

.zip

 

contained within a 

.zip

).

For more information, including an example of how to use the 

scanconfig

 

command to set the attachment scanning behavior, see 

.

count: if (addr-count("To", "Cc") > 30) {

            strip-header("To");

            strip-header("Cc");

            insert-header("To", "undisclosed-recipients");

           }