Cisco Cisco Email Security Appliance C160 Mode D'Emploi

You can also use the $MatchedContent action variable to notify senders or 
administrators that a content filter was triggered. The $MatchedContent action 
variable displays the content that triggered the filter. For example, the following 
filter sends a notification to an administrator if the email contains ABA account 
information.

You can use the Text Resources page or the 

textconfig

 CLI command to 

configure custom notification templates as text resources for use with the 

notify()

 and 

notify-copy()

 actions. If you do not create a custom notification 

template, a default template is used. The default template includes message 
headers, but the custom notification template does not include message headers 
by default. To include message headers in the custom notification, include the 

$AllHeaders

 action variable. 

 For more information, see the “Text Resources” chapter in the Cisco IronPort 
AsyncOS for Email Configuration Guide. 

in the following example, when a large message triggers the filter shown below, 
an email is sent to the intended recipients explaining that the message was too 
large:

ABA_filter:

if (body-contains ('*aba')){

notify('admin@example.com','[$MatchedContent]Account Information 

Displayed');

}

bigFilter:

   if (body-size >= 4M)

   {

        notify('$EnvelopeRecipients', '[$FilterName] Message too large',