Cisco Cisco Email Security Appliance C160 Mode D'Emploi

In the following example, at any given point in time, if the filter detects 

X

 or more outgoing messages 

from same envelope sender in the last one hour, the subsequent messages from the same envelope sender 
are dropped and discarded. 

In the following example, at any given point in time, if the filter detects 

X

 or more incoming or outgoing 

messages with identical subject in the last one hour, the administrator is notified for every subsequent 
message with identical subject. 

Use a URL reputation rule to define message actions based on the reputation score of any URL in the 
message. For important details, see 

 in 

 

For these rules: 

msg_filter_name

: is the name of this message filter.

whitelist

 is the name of a defined URL list (via the 

urllistconfig

 command.) Specifying a 

whitelist is optional. 

Use the 

url-reputation

 rule. 

Filter syntax when using a 

url-reputation

 rule is: 

<msg_filter_name>: 

if url-reputation(<min_score>, <max_score>, '<whitelist>') 

{<action>}

Where: 

min_score

 and 

max_score 

are the minimum and maximum scores in the range for which the action 

should apply. The values that you specify are included in the range. 

Minimum and maximum scores must be between 

-10.0

 and 

10.0

. 

Use the 

url-no-reputation

 rule. 

Filter syntax when using a 

url-no-reputation

 rule is: 

<msg_filter_name>: 

if url_no_reputation('<whitelist>') 

{<action>} 

Use URL categories to define message actions based on the category of URLs in the message. For 
important details, see 

 

in 

 

f2 :  if header-repeats('mail-from', X, 'outgoing') {drop();}

f3: if header-repeats('subject', X) {notify('admin@xyz.com');}