Cisco Cisco Email Security Appliance C160 Mode D'Emploi

opposed to the “body” of the message (the first, plain text part) — although, 
according to the language used in RFCSs 1521 and 1522, a message’s body is 
comprised of all MIME parts. 

Because the IronPort appliance makes this distinction between the body and the 
attachment in multipart messages, there are several cases you should be aware of 
when using the 

body-

variable or 

attachment-

variable message filter rules in 

order to achieve the expected behavior:

If you have a message with a single text part—that is, a message containing 
a header of “Content-Type: text/plain” or “Content-Type: text/html” — the 
IronPort appliance will consider the entire message as the body. If the content 
type is anything different, the IronPort appliance considers it to be a single 
attachment.

Some encoded files (uuencoded, for example) are included in the body of the 
email message. When this occurs, the encoded file is treated as an attachment, 
and it is extracted and scanned, while the remaining text is considered to be 
the body of the text. 

A single, non-text part is always considered an attachment. For example, a 
message consisting of only a.zip file is considered an attachment.

When you add filter rules that search for patterns in the message body or 
attachments, you can specify the minimum threshold for the number of times the 
pattern must be found. When AsyncOS scans the message, it totals the “score” for