Cisco Cisco Email Security Appliance X1070 Guia De Informação

Contributed by Jason Sikorski and Stephan Bayer, Cisco TAC
Engineers.

Jul 31, 2014

Can you provide an example mail filter on How to Quarantine a Message?

Below is an example of a correctly written filter for quarantining certain messages:

quarantineMessages:

if (mail−from == 'foo@bar\\.org')

{

 quarantine('MyQuarantine');

}

When creating a message filter or content filter, keep in mind the difference between final and non−final filter
actions.

Non−final actions allow additional actions to be applied by the current filter and subsequent filters. 

A final action stops the current message from being processed further.

There are three (3)  final actions:

drop()

• 

bounce()

• 

deliver()

• 

When writing a filter to quarantine a message, it is important not to use a final action after quarantining
the message. Doing so will release the message from the quarantine so the final action can be performed.

For more information about message filters, see the AsyncOS Advance User Guide on the Cisco Support Site.

Updated: Jul 31, 2014

Document ID: 118139