Cisco Cisco Email Security Appliance C160 Mode D'Emploi

The 

attachment

-

dictionary-match(<dictonary_name>)

 rule works like the 

dictionary-match

 rule above, except that it looks for matches in the attachment. 

The following filter sends the message to the Policy quarantine if the message 
attachment contains any words found within the dictionary named 
“secret_words.”

quarantine_codenames_attachment:  

   if (attachment-dictionary-match ('secret_words')) 

       {

       quarantine('Policy');

       }

The 

header

-

dictionary-match(<dictonary_name>, <header>)

 rule works like 

the dictionary-match rule above, except that it looks for matches in the header 
specified in <header>. The header name is case insensitive, so, for example, 
“subject” and “Subject” both work.

The following filter sends the message to the Policy quarantine if the message’s 
“cc” header contains any words found within the dictionary named 
“ex_employees.”

quarantine_codenames_attachment:  

   if (header-dictionary-match ('ex_employees', 'cc')) 

       {

       quarantine('Policy');

       }

You can use wild cards within the dictionary terms. You do not have to escape the 
period in email addresses.