Cisco Cisco Email Security Appliance C160 Mode D'Emploi
Chapter 6 Using Message Filters to Enforce Email Policies
6-298
Cisco IronPort AsyncOS 7.3 for Email Advanced Configuration Guide
OL-23081-01
Overview
Message filters allow you to create special rules describing how to handle
messages as they are received by the Cisco IronPort appliance. A message filter
specifies that a certain kind of email message should be given special treatment.
IronPort message filters also allow you to enforce corporate email policy by
scanning the content of messages for words you specify. This chapter contains the
following sections:
messages as they are received by the Cisco IronPort appliance. A message filter
specifies that a certain kind of email message should be given special treatment.
IronPort message filters also allow you to enforce corporate email policy by
scanning the content of messages for words you specify. This chapter contains the
following sections:
•
Components of a message filter. Message filters allow you to create special
rules describing how to handle messages as they are received. Filter rules
identify messages based on message or attachment content, information about
the network, message envelope, message headers, or message body. Filter
actions generate notifications or allow messages to be dropped, bounced,
archived, blind carbon copied, or altered. For more information, see
rules describing how to handle messages as they are received. Filter rules
identify messages based on message or attachment content, information about
the network, message envelope, message headers, or message body. Filter
actions generate notifications or allow messages to be dropped, bounced,
archived, blind carbon copied, or altered. For more information, see
.
•
Processing Message Filters. When AsyncOS processes message filters, the
content that AsyncOS scans, the order of the processing, and the actions taken
are based on several factors, including the message filter order, any prior
processing that may have altered the message content, the MIME structure of
the message, the threshold score configured for content matching, and
structure of the query. For more information, see
content that AsyncOS scans, the order of the processing, and the actions taken
are based on several factors, including the message filter order, any prior
processing that may have altered the message content, the MIME structure of
the message, the threshold score configured for content matching, and
structure of the query. For more information, see
•
Message Filter Rules. Each filter has a rule that defines the collection of
messages that the filter can act upon. You define those rules when you create
a message filter. For more information, see
messages that the filter can act upon. You define those rules when you create
a message filter. For more information, see
.
•
Message Filter Actions. Each filter has an action that is performed on a
message if the rule evaluates to
message if the rule evaluates to
true
. There are two types of actions that can
be performed: final actions (such as delivering, dropping, or bouncing a
message), or non-final actions (such as stripping or inserting a header) which
permit the message to be further processed. For more information, see
message), or non-final actions (such as stripping or inserting a header) which
permit the message to be further processed. For more information, see
.
•
Attachment Scanning Message Filters. Attachment scanning message
filters allow you to strip attachments from messages that are inconsistent with
your corporate policies, while still retaining the ability to deliver the original
message. You can filter attachments based on their specific file type,
fingerprint, or content. You can also scan image attachments using an image
analyzer. The image analyzer creates algorithms to measure skin color, body
filters allow you to strip attachments from messages that are inconsistent with
your corporate policies, while still retaining the ability to deliver the original
message. You can filter attachments based on their specific file type,
fingerprint, or content. You can also scan image attachments using an image
analyzer. The image analyzer creates algorithms to measure skin color, body