Cisco Cisco Email Security Appliance C170 Mode D'Emploi

Contains text. Does the message contain an attachment that contains text 
or another attachment that matches a specific pattern? This rule is similar 
to the 

body-contains()

 rule, but it attempts to avoid scanning the entire 

“body” of the message. That is, it attempts to scan only that which the user 
would view as being an attachment.

Contains a smart identifier. Does content in the message attachment 
match the specified smart identifier?

Contains terms in content dictionary. Does the attachment contain any 
of the regular expressions or terms in the content dictionary named 
<dictionary name>?

To search for dictionary terms, the dictionary must already have been 
created. See 

.

The dictionary-related conditions are only available if you have 
one or more dictionaries enabled. For information about creating 
content dictionaries, see 

.

Number of matches required. Specify the number of matches required 
for the rule to evaluate to true. You can specify this threshold for text, smart 
identifier, or content dictionary matches.