Cisco Cisco Email Security Appliance C160 Mode D'Emploi

The action is what the Email Security appliance does with a message that matches the content filter’s 
condition. Many different types of actions are available, including modifying the message, quarantining 
it, or dropping it. A “final action” performed on a message, delivering or dropping it, forces the Email 
Security appliance to perform the action immediately and forgo all further processing, such as Outbreak 
Filter or DLP scanning.

At least one action must be defined for each content filter. 

Actions are performed in order on messages, so consider the order of actions when defining multiple 
actions for a content filter. 

When you configure a quarantine action for messages that match Attachment Content conditions, 
Message Body or Attachment conditions, Message body conditions, or the Attachment content 
conditions, you can view the matched content in the quarantined message. When you display the 
message body, the matched content is highlighted in yellow. You can also use the 

$MatchedContent

 

action variable to include the matched content in the message subject. For more information, see the Text 
Resources chapter.

Is the message (subject and body) in one of the selected languages? This 
condition will not check for the language in attachments and headers.

Cisco Email Security appliance uses the built-in language detection engine 
to detect the language in a message. The appliance extracts the subject and 
the message body and passes it to the language detection engine.

The language detection engine determines the probability of each language 
in the extracted text and passes it back to the appliance. The appliance 
considers the language with the highest probability as the language of the 
message. The appliance considers the language of the message as 
‘undetermined’ in one of the following scenarios:

If the detected language is not supported by Cisco Email Security 
appliance

If the appliance is unable to detect the language of the message

If the total size of the extracted text sent to the language detection 
engine is less than 50 bytes.

Does the message contain duplicate MIME boundaries?

If you want to take actions on messages that contain duplicate MIME 
boundaries, use this condition. 

Attachment-based conditions (for example, Attachment Content) 
or actions (for example, Strip Attachment by Content) will not 
work on malformed messages (with duplicate MIME boundaries).