Cisco Cisco Email Security Appliance C160 Mode D'Emploi

The 

body-contains

 filter rule would determine the score for this message by first 

scoring the text/plain and text/html parts of the message. It would then compare 
the results of these scores and select the highest score from the results. Next, it 
would add this result to the score from each of the attachments to determine the 
final score. Suppose the message has the following number of matches: 

multipart/mixed

        multipart/alternative

                text/plain (2 matches)

                text/html (2 matches)

        application/octet-stream (1 match)

        application/octet-stream

Because AsyncOS compares the matches for the text/plain and text/html parts, it 
returns a score of 3, which does not meet the minimum threshold to trigger the 
filter rule.

When you use a content dictionary, you can “weight” terms so that certain terms 
trigger filter actions more easily. For example, you may want not want to trigger 
a message filter for the term, “bank.” However, if the term, “bank” is combined 
with the term, “account,” and accompanied with an ABA routing number, you 
may want to trigger a filter action. To accomplish this, you can use a weighted 
dictionary to give increased importance to certain terms or a combination of 

        application/octet-stream

        application/octet-stream