Cisco Cisco Email Security Appliance C160 Mode D'Emploi

The following example sends the message to the Policy quarantine if the message body contains any 
words within the dictionary named “secret_words.” Unlike the 

only-body-contains

 condition, the 

body-dictionary-match

 condition does not require that all the content parts individually match the 

dictionary. The scores of each content part (taking into account multipart/alternative parts) are added 
together.

In the following filter, a subject that matches a term in the specified dictionary is quarantined:

This example matches an email address in the “to” header and blind copies an administrator:

The 

attachment

-

dictionary-match(<dictonary_name>)

 rule works like the 

dictionary-match

 rule 

above, except that it looks for matches in the attachment. 

The following filter sends the message to the Policy quarantine if the message attachment contains any 
words found within the dictionary named “secret_words.”

quarantine_data_loss_prevention:  

   if (body-dictionary-match ('secret_words')) 

       {

       quarantine('Policy');

       }

quarantine_policy_subject:  

    if (subject-dictionary-match ('gTest'))

        {

        quarantine('Policy');

        }

headerTest:

    if (header-dictionary-match ('competitorsList', 'to'))

        {

        bcc('administrator@example.com');

        }

quarantine_codenames_attachment:  

   if (attachment-dictionary-match ('secret_words')) 

       {