Cisco Cisco Email Security Appliance C160 Mode D'Emploi
9-48
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
To take action when the reputation service does not provide a score:
Use the
url-no-reputation
rule.
Filter syntax when using a
url-no-reputation
rule is:
<msg_filter_name>:
if url_no_reputation('<whitelist>')
{<action>}
URL Category Rule
Use URL categories to define message actions based on the category of URLs in the message. For
important details, see
important details, see
in
Filter syntax when using a
url-category
rule is:
<msg_filter_name>: if url-category ([‘<category-name1>’,’<category-name2>’,…,
‘<category-name3>’],’<url_white_list>’)
{
<action>
}
Where:
•
msg_filter_name
is the name of this message filter.
•
action
is any message filter action.
•
category-name
is the URL category. Separate multiple categories with commas. To obtain correct
category names, look at a URL Category condition or action in a Content Filter. For descriptions and
examples of the categories, see
examples of the categories, see
.
•
url_white_list
is the name of a defined URL list (via the
urllistconfig
command.)
Corrupt Attachment Rule
The Corrupt Attachment rule evaluates to
true
if a message contains corrupt attachment. A corrupt
attachment is an attachment that the scanning engine cannot scan and identified as corrupt.
Related Topics
•
Example
In the following example, if the filter detects a corrupt attachment in a message, the message is
quarantined to Policy Quarantine.
quarantined to Policy Quarantine.
Message Language Rule
You may want to take different message actions based on the message language. For example, you may
want to:
want to:
quar_corrupt_attach: if (attachment-corrupt) { quarantine("Policy"); }