Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
C H A P T E R
11-1
Cisco AsyncOS 8.0.2 for Email User Guide
11
Content Filters
•
•
•
Overview of Content Filters
Sometimes the Email Security appliance receives a message that should be given special treatment due
to its content, whether it’s because the content warrants quarantining for later examination, because
corporate policy requires certain messages to be encrypted before delivery, or any number of reasons.
These are cases when the message cannot be handled by the other content security features, such as
anti-virus scanning or DLP. The appliance uses content filters to scan for such content and then take
appropriate action on the message.
to its content, whether it’s because the content warrants quarantining for later examination, because
corporate policy requires certain messages to be encrypted before delivery, or any number of reasons.
These are cases when the message cannot be handled by the other content security features, such as
anti-virus scanning or DLP. The appliance uses content filters to scan for such content and then take
appropriate action on the message.
How Content Filters Work
Content filters are similar to message filters, but are applied after the message has undergone message
filters processing and anti-spam and anti-virus scanning. The Email Security appliance uses content
filters to scan messages on a per-user (sender or recipient) basis. Content filters are similar to message
filters, except that they are applied later in the email pipeline — after a message has been “splintered”
into a number of separate messages for each matching mail policy. (See
filters processing and anti-spam and anti-virus scanning. The Email Security appliance uses content
filters to scan messages on a per-user (sender or recipient) basis. Content filters are similar to message
filters, except that they are applied later in the email pipeline — after a message has been “splintered”
into a number of separate messages for each matching mail policy. (See
for more information.) The functionality of content filters is applied after message filters processing and
anti-spam and anti-virus scanning have been performed on a message.
anti-spam and anti-virus scanning have been performed on a message.
A content filter is limited to scanning either incoming or outgoing messages. You cannot define a filter
that scans both types of messages. The Email Security appliance has a separate “master list” of content
filters for each type of message. The master list also determines in which order the appliance runs the
content filters. However, each individual mail policy determines which particular filters will be executed
when a message matches the policy.
that scans both types of messages. The Email Security appliance has a separate “master list” of content
filters for each type of message. The master list also determines in which order the appliance runs the
content filters. However, each individual mail policy determines which particular filters will be executed
when a message matches the policy.
AsyncOS provides a “rule builder” page that allows you to easily create the content filter using four
parts:
parts:
•
conditions that trigger when the appliance uses a content filter to scan a message (optional)
•
actions that the appliance takes on a message (required)
•
action variables that the appliance can add to a message when modifying it (optional)