Cisco Cisco Email Security Appliance X1070 Guia Do Utilizador
9-16
Cisco AsyncOS 9.5 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Each message injected into the Cisco appliance is processed through all message filters in order, unless
you specify a final action, which stops the message from being processed further. (See
you specify a final action, which stops the message from being processed further. (See
.) Filters may also apply to all messages, and rules may also be combined using logical
connectors (AND, OR, NOT).
Signed Certificate
signed-certificate(<field>
[<operator> <regular
expression>])
Does the message signer or X.509 certificate
issuer match a certain pattern? See
issuer match a certain pattern? See
Header Repeats
header-repeats (<target>,
<threshold> [, <direction>])
Returns
true
if at a given point in time, a
specified number of messages:
•
With same subject header are detected in
last one hour.
last one hour.
•
From same envelope-sender are detected in
last one hour.
last one hour.
See
URL Reputation
url-reputation
url-no-reputation
Is the reputation score of any URL in the
message within the specified range?
message within the specified range?
Is a reputation score for a URL unavailable?
See
URL Category
url-category
Does the category of any URL in the message
match the specified categories?
match the specified categories?
See
Corrupt Attachment
attachment-corrupt
Does this message have an attachment that is
corrupt?
corrupt?
See
.
a.Attachment filtering is discussed in detail in the section
.
b.Content Dictionaries are discussed in the detail in the “Text Resources” chapter.
Table 9-2
Message Filter Rules
Rule Syntax
Description