Cisco Cisco Email Security Appliance C170 ユーザーガイド

require that all the content parts individually match the dictionary. The scores of 
each content part (taking into account multipart/alternative parts) are added 
together.

In the following filter, a subject that matches a term in the specified dictionary is 
quarantined:

This example matches an email address in the “to” header and blind copies an 
administrator:

quarantine_data_loss_prevention:  

   if (body-dictionary-match ('secret_words')) 

       {

       quarantine('Policy');

       }

quarantine_policy_subject:  

    if (subject-dictionary-match ('gTest'))

        {

        quarantine('Policy');

        }

headerTest:

    if (header-dictionary-match ('competitorsList', 'to'))

        {

        bcc('administrator@example.com');

        }